Can't Flash Netgear R6850

After some more research, I'm wondering if I've encountered this problem. Given that the R6350 has similar (identical?) firmware to the R6850, I was able to use the process referenced in the R6350 hardware page to enable debug mode and telnet into the stock firmware. The MTD layout looks similar to the one in the R6350 thread. From my R6850 on stock firmware:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "Bootloader"
mtd1: 00100000 00020000 "SC_PART_MAP"
mtd2: 00420000 00020000 "Kernel"
mtd3: 02800000 00020000 "Rootfs"
mtd4: 00200000 00020000 "English UI"
mtd5: 00200000 00020000 "ML1"
mtd6: 00200000 00020000 "ML2"
mtd7: 00200000 00020000 "ML3"
mtd8: 00200000 00020000 "ML4"
mtd9: 00200000 00020000 "ML5"
mtd10: 00200000 00020000 "ML6"
mtd11: 00200000 00020000 "ML7"
mtd12: 00200000 00020000 "ML8"
mtd13: 00200000 00020000 "ML9"
mtd14: 00200000 00020000 "ML10"
mtd15: 00200000 00020000 "ML11"
mtd16: 00220000 00020000 "Factory"
mtd17: 00200000 00020000 "SC Private Data"
mtd18: 00200000 00020000 "POT"
mtd19: 00200000 00020000 "Traffic Meter"
mtd20: 00200000 00020000 "SC PID"
mtd21: 00220000 00020000 "SC Nvram"
mtd22: 00200000 00020000 "Ralink Nvram"
mtd23: 00200000 00020000 "Reserved Block1"
mtd24: 00200000 00020000 "Reserved Block2"
mtd25: 00200000 00020000 "Reserved Block3"
mtd26: 00200000 00020000 "Reserved Block4"
mtd27: 00200000 00020000 "Reserved Block5"
mtd28: 02120000 00020000 "Reserved Block6"

Any thoughts?