Comcast has a prepaid "Xfinity NOW" service that's cheaper than normal Xfinity, with unlimited data instead of a 1.2TB/month cap. If you currently have Xfinity, the NOW online signup is hidden, but when I called to cancel my Xfinity service on a date a couple weeks in the future, the NOW signup started working immediately. (I initially queried a neighbor's address to confirm that NOW was available in my area.)
The catch is that you can't use your own modem. They provide a free Arris TG1682P (also known as the XB3), but it's huge and uses more power (14.9 watts) than my Arris SB8200 (9.8 watts). I suspect they retired millions of these things and treat NOW as a recycling service.
The XB3 lets you enable bridge mode via the admin page at http://10.0.0.1/, and IPv4/IPv6 works just like a plain modem, but even in bridge mode, the gateway broadcasts several hidden SSIDs with no option to disable the radios. Curiously I did not see an xfinitywifi broadcast, but your modem may vary.
I found reversible hardware mod to disable the WiFi radios.
Refer to this disassembly video. There are 6 screws (2 hidden), lots of plastic prying, and you will probably wrinkle the rear sticker.
My circuit board is labeled TG1682/TG2472:
Notice the two shielded WiFi modules. The shields just pop off but you can leave them on. In between is an 8-pin chip labeled "54328", a TPS54328 buck regulator. My meter shows that pins 6-7 (Vout) connect to various pins on both Atheros WiFi chips. Pin 1 is EN/enable. It measures 3.3 volts, and when I connect it directly to ground, it sinks negligible current.
So that's the mod. Connect Pin 1 on the 54328 to anything grounded. I used the far side of this nearby capacitor:
The XB3's idle power consumption dropped from 14.9 watts to 12.5 watts, the WiFi lights are off, and everything else seems to work via wired ethernet. I notice that http://10.0.0.1/ is inaccessible (connection refused or HTTP 503) for a few minutes after booting, but it wakes up eventually.
I don't actually know what circuit pulls up the EN pin, so it's possible that I'm overloading a digital output somewhere. I just measured amps to ground and saw a small number. My first idea was to lift the pin before soldering the wire, but I found that too difficult.
The XB3 uses an Intel Puma 6 chipset, which has been in the news over the years due to latency/jitter problems. So far I'm not seeing anything weird on https://gfblip.appspot.com/ or https://speed.cloudflare.com/.
I'll leave another hardware mod here as well...
I really wanted this modem to be able to be powered by (external) DC instead of the AC-DC adapter that is built-in. Doing so would allow me to power it off of my large battery backup system much more efficiently with just a DC-DC step-down converter instead of having to go through a DC-AC inverter just to then step the AC back down to DC again. I also can't find a DC-AC inverter that would run directly off of my external power supply (19.5v) or external battery (4S li-ion, 16.8v-12v range), so I'd also need a step-down DC-DC prior to the inverter.
After some investigation, it appears that the onboard AC-DC adapter outputs 12v, which is then directly fed into a bunch of onboard DC-DC converters to step it down to 5v, 3.3v, 1.5v, 1.3v, 1v, etc... It looks like the DC-DC converters are rated for up to 18v (or higher), but most of the bulk capacitors are only 16v, so 15v is probably the absolute maximum that should be used. It would probably run down to 6v or so, although I didn't try that. Since my input is as high as 19.5v anyway, I'll just use a DC-DC step down set to 12v to match the existing onboard converter and try to inject that directly onto the '12v' rail.
My first attempt to inject 12v DC into the modem almost worked, but for some reason the 5v dc-dc wasn't running and I never got a link on the ethernet ports. After some investigation, it appears there is some type of 'power good' wizardry happing with some diodes and mosfets near the output of the onboard AC-DC adapter. Q702 is pulling down a signal that runs to the EN pin of the 5v regulator, and which possibly routes elsewhere. Simply removing the Q702 mosfet seems to have fixed the problem, though, and I can now successfully power this with external DC power!
With both mods, this modem now uses about 9-10W (from the input side of the DC-DC step-down, MP1584 based). Much more reasonable!
Please be careful if you try to replicate this mod, and I take no responsibility if you destroy your modem or get zapped. Probably would be best to remove the AC input connector so it can't be used accidentally.