it sha256sum of ath10k-firmware-2018-10-10-d366b80d.tar.xz
which defined at [here][ref]
[ref]: https://github.com/openwrt/openwrt/blob/master/package/firmware/ath10k-firmware/Makefile#L13

that
6285b9f9aa5a541b8258750f36955a6b307903a87cedd842b73dbfdd2bef8986
is out of date, and should be
ec06f10e6b1d4f7a28366a893c8a73a000454c2f031fc747381a1fb8aa1e0846

i've checked many times from all mirrors (if it valid), list below:

from https://github.com/openwrt/openwrt/blob/master/scripts/download.pl#L260-L263

#push @mirrors, 'https://mirror1.openwrt.org';
push @mirrors, 'https://sources.lede-project.org';
push @mirrors, 'https://mirror2.openwrt.org/sources';
push @mirrors, 'https://downloads.openwrt.org/sources';

P.S

when make download dis match reach the limit times,
make will turn to git checkout mode as a backup.

but the backup wont working,
as a bug https://dev.archive.openwrt.org/ticket/20529 said,
it will not invoke host's new version tar,
which the building is not begin.

"so make download need a newer tar to download that must download newer tar first",
if sha256sum of tar dis match and exists system's tar is old.

i mean it will trigger error "tar: unrecognized option '--sort=name'",
and the backup wont working as expected (backup).

okay, it seems all url downloading operation should route to hash (sha256sum or md5sum).
why "Automate QC"/CI, check all openwrt source tree to avoid hash dis match.