Bought several 4040's for a MESH network (OEM firmware 7.14) see also Global DG's Network and have one for OEM/OpenWrt testing.
Here you can find al adjusted hardware done to the box.
Made a TTL-serial output on the last one (between WAN and LAN connections) and have already some (OEM) logs from it here...
From left to right: GND, RX, TX, +3.3V
According https://openwrt.org/toh/avm/avm_fritz_box_4040 soldered the output internally to the board.
(Below the connections are: +3.3V, Tx, RX, GND)
Further this one has the next available connections:
More software related issues (OEM & OpenWrt) as well as logs can be found here...
DG.