Just a guesstimate that maybe the cloud app continuously connected and or RTSP streaming locks some of the upgrading of firmware files.
The app was connected but it wasn't running on my phone at the time.
Once the doorbell is configured to the cloud app it remains connected whether you are using the app or not. There might be something in the app running that restricts the upgrade of firmware only to the vendor cloud stored firmware files. (well RCA firmware files only?)
1 - guessing the download went fine - right? You saw it.
2 - then the firmware unzips files in the camera OS - Maybe at this time it just will not write to running files??
3 - when it reboots then maybe it never completes the firmware installation.
Mentioning this because when I upgraded to the Hikvision firmware I was already not using the cloud app and the doorbell was no longer connected to it and I was not proactively streaming RTSP to my NVR or any application.
BTW one of the first things I did with the original firmware / Nelly camera was test the cloud connection then disconnect from it and not utilize any apps on my phones or tablets. Then I went to editing stuff on the Doorbell camera with the Batch Configuration program. Around this time did upgrade the firmware to a newer Nelly posted firmware with no issues. I even have two user accounts now set up on the camera. Both of the users are admin. If I do a back up here and look at the file there are pieces of my EZViz configuration in the file still which I would like to get rid of. I also see mobile profiles in the ONVIF configuration program but they are ghosted and I cannot change them.
Looking at the bin back up configuration file using a hex editor see some stuff there ezviz links, original ap ssid.
dev.ezviz7.com - 52.5.24.116 Amazon cloud
alarm.ezviz7.com - 34.234.180.196 Amazon cloud
litedev.us.ezvizlife.com - 35.174.95.139 Amazon cloud
See my original to EZViz login.
When I log in to EZViz and try to configure or add the camera application states it is no longer seeing the camera. This might be due to my PFSense Configuration of PFBlocker and other stuff.
Originally using the ONVIF editor did see an NTP link to China with time set to local Chinese time. I changed all of this stuff using the ONVIF editor to make it match what I configured in the Batch Configuration program.
View attachment 62018
Looking at internal pictures of the camera do see a JTAG port on it. You do not want to do this though.
MAYBE you can write the original RCA DAV bin file to the SD card and hit the reset on the camera to see if it loads the firmware bin file. I mean you have bricked the camera so you are returning it so it doesn't hurt to try this.
View attachment 62030
View attachment 62031