Problem solved.
I rolled up my sleeves, set up my ssh key, and logged into the router to peer under the hood.
After some investigation and tests, I found that the ddns updater script was rejecting my public WAN IP, which was assigned by AT&T from the 172.8.xxx.xxx range.
Line 588 of /usr/lib/ddns/dynamic_dns_updater.sh
had a filter to exclude private IP subnets:
[ $use_ipv6 -eq 0 ] && __IP=$(echo $1 | grep -v -E "(^0|^10\.|^127|^172|^192)") # no private IPv4's
But only a portion of the 172. and 192. ranges are private: 172.16.0.0/12 (172.16.0.0 – 172.31.255.225) and 192.16.0.0./16 (192.168.0.0 – 192.168.255.255): https://www.arin.net/knowledge/address_filters.html
I updated the filter to only exclude IPs in those ranges (changed line 588, and added a line):
[ $use_ipv6 -eq 0 ] && __IP=$(echo $1 | grep -v -E "(^0|^10\.|^127|^192\.168)") # no private IPv4's
[ $use_ipv6 -eq 0 ] && __IP=$(echo $1 | grep -v -E “^172\.(1[6-9]|2[0-9]|3[0-1])\.”) # no private 172.16.0.0/12 IPv4s`
After that, I was able to set and save and confirm my Dynamic DNS updater settings in the pcwrt interface.
Unfortunately, however, this change I made will be wiped out next time I update the OS, unless it’s folded into the pcwrt codebase. Can you open this up as a bug, and apply the fix with the next release of the OS?
FWIW, the latest version of this script in the openwrt github repo correctly filters private address spaces:
https://github.com/openwrt/packages/blob/master/net/ddns-scripts/files/dynamic_dns_functions.sh#L852