Set up a TFTP server. Have it host the initramfs file but rename it to um_factory_fw.bin
There won't be time to do a DHCP exchange so configure the TFTP server (or the host running the server) to have a 192.168.1.100 address on a 255.255.255.0 subnet.
Connect with an ethernet cable and power the RE6500 on. Immediately after receiving power the RE6500 will make a TFTP request and boot the um_factory_fw.bin into memory. This will effectively boot a live version of OpenWrt. You will know that you did it right if the extender has both the white and orange LEDs on after it is done booting, resulting in a milky white led with a distinct orange hue. The original firmware never lights them at the same time. The individual LEDs can also be observed through the front grille.
Use OpenWrt's web interface at 192.168.1.1 and login with root/admin. From here you can flash the sysupgrade image.
Don't forget to shut down the TFTP server or you'll just load the initramfs image again! After rebooting the extender you should now have OpenWrt running from the device.
For your protection…Linksys thoughtfully LOCKED the Bootloader on this device.
If you need the password it is 1234567890 :)
The original firmare doesnt allow using the device as a Wi-Fi access point: an existing WiFi network is *mandatory*. It only works as an extender. It would be interesting to know if the device is capable of providing this AP functionality using the OpenWrt firmware.
The original firmware 1.0.08, release on Dec 27 2017 provides two Operation Modes: Wireless Range Extender or Access Point (Wired Range Extender)