On the raspi3 armhf image the config.txt in the unmounted /boot/firmware is from livecd-rootfs (so doesn't have the correct fdt address). The uboot.bin is the pi2 version.
Investigating where these files came from I noticed that both livecd-rootfs and u-boot-rpi use mkknlimg to copy uboot.bin to /boot/firmware. However, they use different settings with the command.
The pi3 classic snap gadget does not to use mkknlimg.
mkknlimg should be used consistently across the packages/snaps.
Expanding comment #46 above...
On the raspi3 armhf image the config.txt in the unmounted /boot/firmware is from livecd-rootfs (so doesn't have the correct fdt address). The uboot.bin is the pi2 version.
Investigating where these files came from I noticed that both livecd-rootfs and u-boot-rpi use mkknlimg to copy uboot.bin to /boot/firmware. However, they use different settings with the command.
The pi3 classic snap gadget does not to use mkknlimg.
mkknlimg should be used consistently across the packages/snaps.