"That is heavily SOC- and device dependent. In most cases, the kernel is outside the rootfs on a dedicated flash partition (e.g. a hard mtd, a virtual one via mtdsplit or an ubi partition, it depends), the OEM bootloader typically loads a hardcoded amount of bytes from a given flash offset and loads the kernel from there."
"OEM Bootloader" is a fancy way of saying CFE in Broadcom terms, that is. (Atheros does not use a CFE) The OpenWRT developers like fancy. Us folks over here just want the stuff to work...