Successed. The method is similar to @GloooM member in this topic.
I have modified mtd3(name "cdt") at offset 0x07B from value 0E to 0F.
Because the old ram chip (Nanya 128Mx16) has 14 row address, the replacement ram chip is Micron(256Mx16) has 15 row address.
Summary
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00108
S - IMAGE_VARIANT_STRING=DAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000025
S - Reset status Config, 0x00000010
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1338 - bootable_media_detect_entry, Start
B - 2608 - bootable_media_detect_success, Start
B - 2622 - elf_loader_entry, Start
B - 4029 - auth_hash_seg_entry, Start
B - 6179 - auth_hash_seg_exit, Start
B - 74240 - elf_segs_hash_verify_entry, Start
B - 196034 - PBL, End
B - 196059 - SBL1, Start
B - 288078 - pm_device_init, Start
D - 7 - pm_device_init, Delta
B - 289568 - boot_flash_init, Start
D - 87161 - boot_flash_init, Delta
B - 381032 - boot_config_data_table_init, Start
D - 13980 - boot_config_data_table_init, Delta - (419 Bytes)
B - 397770 - clock_init, Start
D - 7581 - clock_init, Delta
B - 408784 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:6
B - 412198 - sbl1_ddr_set_params, Start
B - 417292 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 421675 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13172 - sbl1_ddr_set_params, Delta
B - 434979 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 504714 - sbl1_wait_for_ddr_training, Start
D - 28 - sbl1_wait_for_ddr_training, Delta
B - 520960 - Image Load, Start
D - 143988 - QSEE Image Loaded, Delta - (269176 Bytes)
B - 665373 - Image Load, Start
D - 2121 - SEC Image Loaded, Delta - (2048 Bytes)
B - 675517 - Image Load, Start
D - 187353 - APPSBL Image Loaded, Delta - (444263 Bytes)
B - 863265 - QSEE Execution, Start
D - 56 - QSEE Execution, Delta
B - 869452 - SBL1, End
D - 675503 - SBL1, Delta
S - Flash Throughput, 2086 KB/s (715906 Bytes, 343180 us)
S - DDR Frequency, 672 MHz
U-Boot 2012.07 [Chaos Calmer 15.05.1,r35193] (Nov 02 2017 - 16:33:09)
CBT U-Boot ver: 1.2.9
smem ram ptable found: ver: 1 len: 3
DRAM: 512 MiB
machid : 0x8010006
NAND: ID = 9590dac2
Vendor = c2
Device = da
ONFI device found
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC: qca_mmc: 0
PCI0 Link Intialized
In: serial
Out: serial
Err: serial
machid: 8010006
flash_type: 2
Net: MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Updating boot_count ... done
root@OpenWrt:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00100000 00020000 "sbl1"
mtd1: 00100000 00020000 "mibib"
mtd2: 00100000 00020000 "qsee"
mtd3: 00080000 00020000 "cdt"
mtd4: 00080000 00020000 "appsblenv"
mtd5: 00080000 00020000 "ART"
mtd6: 00200000 00020000 "appsbl"
mtd7: 00080000 00020000 "u_env"
mtd8: 00040000 00020000 "s_env"
mtd9: 00040000 00020000 "devinfo"
mtd10: 05800000 00020000 "kernel"
mtd11: 05300000 00020000 "rootfs"
mtd12: 05800000 00020000 "alt_kernel"
mtd13: 05300000 00020000 "alt_rootfs"
mtd14: 00100000 00020000 "sysdiag"
mtd15: 04680000 00020000 "syscfg"
root@OpenWrt:~# free
total used free shared buff/cache available
Mem: 505788 86272 372428 308 47088 371272
Swap: 0 0 0