Only non-QFIL/firehose method I can think of that might work is pushing it to device using the READWRTE branch of steadfasterX's lglaf fork (its on github). I nuked my laf partition so can't test, and my laptops USB controller is going kaput. Good luck!
Might end up with a secure boot error, maybe not, might need permissive kernel or patched aboot or both, flash at own risk. Screw AT&T.