On MX5300, if we write something to mtd21/mtd23, the data will also be changed in mtd22/mtd24.
Firmware installation from initramfs (mtd23 is alt_kernel and mtd24 is alt_rootfs):
root@OpenWrt:~# sha256sum /dev/mtd23
f762f6339eee018d11229590bd5f35019dfdb5f4b657fae3c32d3499a7cfa677 /dev/mtd23
root@OpenWrt:~# sha256sum /dev/mtd24
04613e3b1b32b7550cda0070e79a6fcebec0953a2cf1c0c533b7bd5845ede46b /dev/mtd24
root@OpenWrt:~# mtd erase alt_kernel
Unlocking alt_kernel ...
Erasing alt_kernel ...
root@OpenWrt:~# sha256sum /dev/mtd23
b4954ebebc338b6a8747745514c3f37d9d32e3d3359111078a7b40d85a815ae4 /dev/mtd23
root@OpenWrt:~# sha256sum /dev/mtd24
6ea07c08ce177b4963a77d768d29c2e166e5de27c9715ca8ad9dfb85761d844f /dev/mtd24
root@OpenWrt:~# mtd -l 64 dump alt_kernel | hexdump
Dumping alt_kernel ...
0000000 ffff ffff ffff ffff ffff ffff ffff ffff
*
0000040
root@OpenWrt:~# mtd -l 64 dump alt_rootfs | hexdump
Dumping alt_rootfs ...
0000000 ffff ffff ffff ffff ffff ffff ffff ffff
*
0000040
root@OpenWrt:~# mtd -n write /tmp/openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin alt_kernel
Unlocking alt_kernel ...
Writing from /tmp/openwrt-qualcommax-ipq807x-linksys_mx5300-squashfs-factory.bin to alt_kernel ...
root@OpenWrt:~# mtd -l 64 dump alt_kernel | hexdump
Dumping alt_kernel ...
0000000 0dd0 edfe 4b00 2c22 0000 3800 4b00 401e
0000010 0000 2800 0000 1100 0000 1000 0000 0000
0000020 0000 6c00 4b00 081e 0000 0000 0000 0000
0000030 0000 0000 0000 0000 0000 0100 0000 0000
0000040
root@OpenWrt:~# mtd -l 64 dump alt_rootfs | hexdump
Dumping alt_rootfs ...
0000000 4255 2349 0001 0000 0000 0000 0000 0000
0000010 0000 0008 0000 0010 5565 2aff 0000 0000
0000020 0000 0000 0000 0000 0000 0000 0000 0000
0000030 0000 0000 0000 0000 0000 0000 54d0 49b9
0000040