When the nvram is restored via admin-configuration, the file uploaded it stored in the /tmp directory.
For debugging purposes it commented out the following lines in wi_restore in config.c:
rboot = 1;
//if (tmp) unlink(tmp);
This way the router doesn't reboot and the restore file is not removed.
I had a look at the /tmp/restoreXXXXXX file.
Part of the html POST trailer can be found in this temporary file:
cat restoreXXXXXXX #XXXXXXX replaced by the random code
This doesn't look right to me….. the html POST trailer shouldn't be written to nvram.