Used Ubiquiti TFTP recovery method to load recovery image: ER-e50.recovery.v1.10.10.5210345.190714.1127.16de5fdde.img
This worked to recover the ER-X-SFP.
Interesting to see is that the recovery image also happens to have trouble mounting, but here is able to (re)mount mtd7 (mtd5 with OpenWRT):
Creating 7 MTD partitions on "MT7621-NAND":
0x000000000000-0x00000ff80000 : "ALL"
Bad block detected at 0x1c380, oob_buf[0] is 0x0
0x000000000000-0x000000080000 : "Bootloader"
0x000000080000-0x0000000e0000 : "Config"
0x0000000e0000-0x000000140000 : "eeprom"
0x000000140000-0x000000440000 : "Kernel"
0x000000440000-0x000000740000 : "Kernel2"
0x000000740000-0x00000ff00000 : "RootFS"
Bad block detected at 0x1c380, oob_buf[0] is 0x0
[mtk_nand] probe successfully!
UBNT BD mac b4fbe4b704fa kidx 0 mrev 14 serial B4FBE4B704FA type e51
rdm_major = 253
GMAC1_MAC_ADRH -- : 0x0000b4fb
GMAC1_MAC_ADRL -- : 0xe4b704fa
Ralink APSoC Ethernet Driver Initilization. v3.1 512 rx/tx descriptors allocated, mtu = 1500!
GMAC1_MAC_ADRH -- : 0x0000b4fb
GMAC1_MAC_ADRL -- : 0xe4b704fa
PROC INIT OK!
Ralink I2C Init
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
Freeing unused kernel memory: 98488K (81492000 - 874c0000)
devpts: called with bogus options
Starting logging: OK
Initializing random number generator... done.
Starting network: OK
ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519
Starting sshd: NET: Registered protocol family 10
OK
Starting recovery: + modprobe ubnt_platform
ubnt_platform: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Registering char device flash0 (200) succeeds
SFP module inserted
+ awk /board_type/ {print $2} /proc/octeon_info
+ board_type=21001
+ lib=/usr/share/ubnt_edgeos_recovery/lib/21001.inc
+ [ -f /usr/share/ubnt_edgeos_recovery/lib/21001.inc ]
+ progress 1
+ echo 1
1
+ ubinfo -a
+ awk /Count of UBI devices/ {print $5}
+ [ 0 == 1 ]
+ set -e
+ progress 2
+ echo 2
2
+ ubiformat -y /dev/mtd7
ubiformat: mtd7 (nand), size 259784704 bytes (247.8 MiB), 1982 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 29 -- 1 % complete SFP set to 1000 Mbps Full duplex
libscan: scanniBad block detected at 0x1c380, oob_buf[0] is 0x0
libscan: scanning eraseblock 1981 -- 100 % complete
ubiformat: 1981 eraseblocks have valid erase counter, mean value is 6
ubiformat: 1 bad eraseblocks found, numbers: 1748
ubiformat: formattUBI: attaching mtd7 to ubi0 complete
ubiformat: formatting eraseblock 1981 -- 100 % complete
+ progress 3
+ echo 3
3
+ ubiattach -p /dev/mtd7
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 352:2048, read only 2048 bytes, retry
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 352:2048, read only 2048 bytes, retry
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 352:2048, read only 2048 bytes, retry
UBI error: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 352:2048, read 2048 bytes
CPU: 2 T #2
Stack : 874c7c72 00000047 00000000 81470000 00000800 00000160 81419268 874c3bdc
8fc9d1b8 81473567 00000800 00000160 8720a000 ffffffb3 813e0b60 81385130
00000800 81029438 00000000 00000000 8141afa8 871adc94 871adc94 81419268
00000800 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 871adc28
...
Call Trace:
[<81009a10>] show_stack+0x64/0x7c
[<812901c4>] ubi_io_read+0x210/0x3d0
[<81290870>] ubi_io_read_vid_hdr+0x68/0x260
[<81295980>] ubi_attach+0x228/0x1538
[<8128a020>] ubi_attach_mtd_dev+0x604/0xd44
[<8128aa24>] ctrl_cdev_ioctl+0xf4/0x18c
[<810d73c8>] do_vfs_ioctl+0xa4/0x680
[<810d7a44>] SyS_ioctl+0xa0/0xac
[<8100ec10>] stack_done+0x20/0x40
Bad block detected at 0x1c380, oob_buf[0] is 0x0
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 1941:2048, read only 2048 bytes, retry
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 1941:2048, read only 2048 bytes, retry
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 1941:2048, read only 2048 bytes, retry
UBI error: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 1941:2048, read 2048 bytes
CPU: 2 PID: 105 Comm: ubiattach Tainted: P O 3.10.107-UBNT #2
Stack : 874c7c72 00000047 00000000 81470000 00000800 00000795 81419268 874c3bdc
8fc9d1b8 81473567 00000800 00000795 8720a000 ffffffb3 813e0b60 81385130
00000800 81029438 00000000 00000000 8141afa8 871adc94 871adc94 81419268
00000800 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 871adc28
...
Call Trace:
[<81009a10>] show_stack+0x64/0x7c
[<812901c4>] ubi_io_read+0x210/0x3d0
[<81290870>] ubi_io_read_vid_hdr+0x68/0x260
[<81295980>] ubi_attach+0x228/0x1538
[<8128a020>] ubi_attach_mtd_dev+0x604/0xd44
[<8128aa24>] ctrl_cdev_ioctl+0xf4/0x18c
[<810d73c8>] do_vfs_ioctl+0xa4/0x680
[<810d7a44>] SyS_ioctl+0xa0/0xac
[<8100ec10>] stack_done+0x20/0x40
UBI: scanning is finished
UBI: attached mtd7 (name "RootFS", size 247 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 1981, bad PEBs: 1, corrupted PEBs: 0
UBI: user volume: 0, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 9/7, WL threshold: 4096, image sequence number: 278018786
UBI: available PEBs: 1938, total reserved PEBs: 43, PEBs reserved for bad PEB handling: 39
UBI: background thread "ubi_bgt0d" started, PID 106
UBI device number 0, total 1981 LEBs (251539456 bytes, 239.9 MiB), available 1938 LEBs (246079488 bytes, 234.7 MiB), LEB size 126976 bytes (124.0 KiB)
+ progress 4
+ echo 4
4
+ ubimkvol /dev/ubi0 -N troot -m
Set volume size to 246079488
Volume ID 0, size 1938 LEBs (246079488 bytes, 234.7 MiB), LEB size 126976 bytes (124.0 KiB), UBIFS: default file-system created
dynamic, name "tUBIFS: background thread "ubifs_bgt0_0" started, PID 109
root", alignment 1
+ progress 5
+ echo 5
5
+ mount -t ubifs ubi0:troot /mnt
UBIFS: mounted UBI device 0, volume 0, name "troot"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 244428800 bytes (233 MiB, 1925 LEBs), journal size 12189696 bytes (11 MiB, 96 LEBs)
UBIFS: reserved for root: 4952683 bytes (4836 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID 67AF1A36-3CB5-4EBA-BBF4-BE52116C2E81, small LPT model
+ cd /mnt
+ progress 6
+ echo 6
6
+ tar xf /srv/upgrade.tar squashfs.tmp squashfs.tmp.md5 version.tmp
Anybody got an idea why OpenWRT can't perform ubiformat and ubiattach properly while Ubiquiti recovery/firmware still can? Imagine it's either different partition layout, or something with ubiformat/ubiattach binaries?