An awful lot of devices these days ship with firmware that is actually OpenWRT (often v10-v15) based.
The actual NSS kernel modules have source available, and this is pulled into QSDK OpenWRT builds, but they've not had much luck getting stuff upstreamed[1] and getting them working on a recent 4.x kernel is non trivial.
This was also before the netfilter flow offloading framework, so the work is further compounded because they used their own offloading system.