ER-X-SFP bricked after upgrade stock to OpenWrt 18.06.2

As per instruction, I've upgraded multiple ER-X-SFP's to different LEDE/OpenWrt versions.
However, today the procedure bricked a brand new ER-X-SFP:

  1. Started with UBNT stock firmware
  2. Upgrade to openwrt-ramips-mt7621-ubnt-erx-sfp-initramfs-factory.tar using add system image command
  3. Once openwrt initramfs firmware loaded, upgraded using sysupgrade process to upgrade to openwrt-18.06.2-ramips-mt7621-ubnt-erx-sfp-squashfs-sysupgrade.tar

And here's when things went totally bad...
Noticed device was in a boot loop, hooked up to serial console and my worst fear became true:

[  630.059849] ubi0: attaching mtd5
[  632.376956] mtk_nand: UnCorrectable at PageAddr=127937
[  632.387517] ubi0 warning: ubi_io_read: error -5 while reading 64 bytes from PEB 1939:2048, read only 0 bytes, retry
[  632.408724] mtk_nand: UnCorrectable at PageAddr=127937
[  632.419255] ubi0 warning: ubi_io_read: error -5 while reading 64 bytes from PEB 1939:2048, read only 0 bytes, retry
[  632.440469] mtk_nand: UnCorrectable at PageAddr=127937
[  632.450997] ubi0 warning: ubi_io_read: error -5 while reading 64 bytes from PEB 1939:2048, read only 0 bytes, retry
[  632.472234] mtk_nand: UnCorrectable at PageAddr=127937
[  632.482768] ubi0 error: ubi_io_read: error -5 while reading 64 bytes from PEB 1939:2048, read 0 bytes
[  632.501146] CPU: 0 PID: 1105 Comm: ubiattach Not tainted 4.9.58 #0
[  632.513434] Stack : 00000000 00000000 80687b2a 00000036 80408a84 00000000 00000000 80680000
[  632.530078]         8f2cb21c 804edea7 80484e0c 00000000 00000451 80683824 00000800 00000000
[  632.546715]         8f149800 8006b898 80687b2a 00000059 8f2caf00 00000000 804899f4 8fcabc4c
[  632.563354]         fffffffb 800aa050 00000040 00000793 0f260800 00000000 00000800 00cabc4c
[  632.579990]         00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  632.596623]         ...
[  632.601477] Call Trace:
[  632.606351] [<8000f814>] show_stack+0x54/0x88
[  632.615029] [<801e065c>] dump_stack+0x8c/0xd0
[  632.623689] [<8029b948>] ubi_io_read+0x248/0x328
[  632.632866] [<8029becc>] ubi_io_read_vid_hdr+0x94/0x204
[  632.643253] [<802a0fcc>] ubi_attach+0x2e4/0x13f8
[  632.652431] [<80295b14>] ubi_attach_mtd_dev+0x6a8/0xb5c
[  632.662817] [<802967f0>] ctrl_cdev_ioctl+0xe8/0x1bc
[  632.672527] [<80102c88>] vfs_ioctl+0x20/0x40
[  632.681010] [<801034e8>] do_vfs_ioctl+0x72c/0x838
[  632.690360] [<80103644>] SyS_ioctl+0x50/0x9c
[  632.698857] [<800168f8>] syscall_common+0x34/0x58
[  632.709687] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd5, error -5
ubiattach: error!: cannot attach "/dev/mtd5"
           error 5 (I/O error)

It seems that mtd5 in unable to be mounted anymore.
Have tried to format it again using ubiformat /dev/mtd5 but unfortunately it does no longer allow me to mount mtd5.

Anybody got a suggestion how to maybe repartition and be able to mount mtd5 again?

Used Ubiquiti TFTP recovery method to load recovery image: ER-e50.recovery.v1.10.10.5210345.190714.1127.16de5fdde.img

This worked to recover the ER-X-SFP.
Interesting to see is that the recovery image also happens to have trouble mounting, but here is able to (re)mount mtd7 (mtd5 with OpenWRT):

Creating 7 MTD partitions on "MT7621-NAND":
0x000000000000-0x00000ff80000 : "ALL"
Bad block detected at 0x1c380, oob_buf[0] is 0x0
0x000000000000-0x000000080000 : "Bootloader"
0x000000080000-0x0000000e0000 : "Config"
0x0000000e0000-0x000000140000 : "eeprom"
0x000000140000-0x000000440000 : "Kernel"
0x000000440000-0x000000740000 : "Kernel2"
0x000000740000-0x00000ff00000 : "RootFS"
Bad block detected at 0x1c380, oob_buf[0] is 0x0
[mtk_nand] probe successfully!
UBNT BD mac b4fbe4b704fa kidx 0 mrev 14 serial B4FBE4B704FA type e51
rdm_major = 253
GMAC1_MAC_ADRH -- : 0x0000b4fb
GMAC1_MAC_ADRL -- : 0xe4b704fa
Ralink APSoC Ethernet Driver Initilization. v3.1  512 rx/tx descriptors allocated, mtu = 1500!
GMAC1_MAC_ADRH -- : 0x0000b4fb
GMAC1_MAC_ADRL -- : 0xe4b704fa
PROC INIT OK!
Ralink I2C Init
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
Freeing unused kernel memory: 98488K (81492000 - 874c0000)
devpts: called with bogus options
Starting logging: OK
Initializing random number generator... done.
Starting network: OK
ssh-keygen: generating new host keys: RSA DSA ECDSA ED25519
Starting sshd: NET: Registered protocol family 10
OK
Starting recovery: + modprobe ubnt_platform
ubnt_platform: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Registering char device flash0 (200) succeeds
SFP module inserted
+ awk /board_type/ {print $2} /proc/octeon_info
+ board_type=21001
+ lib=/usr/share/ubnt_edgeos_recovery/lib/21001.inc
+ [ -f /usr/share/ubnt_edgeos_recovery/lib/21001.inc ]
+ progress 1
+ echo 1
1
+ ubinfo -a
+ awk /Count of UBI devices/ {print $5}
+ [ 0 == 1 ]
+ set -e
+ progress 2
+ echo 2
2
+ ubiformat -y /dev/mtd7
ubiformat: mtd7 (nand), size 259784704 bytes (247.8 MiB), 1982 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 29 --  1 % complete  SFP set to 1000 Mbps Full duplex
libscan: scanniBad block detected at 0x1c380, oob_buf[0] is 0x0
libscan: scanning eraseblock 1981 -- 100 % complete
ubiformat: 1981 eraseblocks have valid erase counter, mean value is 6
ubiformat: 1 bad eraseblocks found, numbers: 1748
ubiformat: formattUBI: attaching mtd7 to ubi0 complete
ubiformat: formatting eraseblock 1981 -- 100 % complete
+ progress 3
+ echo 3
3
+ ubiattach -p /dev/mtd7
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 352:2048, read only 2048 bytes, retry
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 352:2048, read only 2048 bytes, retry
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 352:2048, read only 2048 bytes, retry
UBI error: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 352:2048, read 2048 bytes
CPU: 2 T #2
Stack : 874c7c72 00000047 00000000 81470000 00000800 00000160 81419268 874c3bdc
          8fc9d1b8 81473567 00000800 00000160 8720a000 ffffffb3 813e0b60 81385130
          00000800 81029438 00000000 00000000 8141afa8 871adc94 871adc94 81419268
          00000800 00000000 00000000 00000000 00000000 00000000 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 00000000 00000000 871adc28
          ...
Call Trace:
[<81009a10>] show_stack+0x64/0x7c
[<812901c4>] ubi_io_read+0x210/0x3d0
[<81290870>] ubi_io_read_vid_hdr+0x68/0x260
[<81295980>] ubi_attach+0x228/0x1538
[<8128a020>] ubi_attach_mtd_dev+0x604/0xd44
[<8128aa24>] ctrl_cdev_ioctl+0xf4/0x18c
[<810d73c8>] do_vfs_ioctl+0xa4/0x680
[<810d7a44>] SyS_ioctl+0xa0/0xac
[<8100ec10>] stack_done+0x20/0x40

Bad block detected at 0x1c380, oob_buf[0] is 0x0
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 1941:2048, read only 2048 bytes, retry
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 1941:2048, read only 2048 bytes, retry
UBI warning: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 1941:2048, read only 2048 bytes, retry
UBI error: ubi_io_read: error -77 (ECC error) while reading 2048 bytes from PEB 1941:2048, read 2048 bytes
CPU: 2 PID: 105 Comm: ubiattach Tainted: P           O 3.10.107-UBNT #2
Stack : 874c7c72 00000047 00000000 81470000 00000800 00000795 81419268 874c3bdc
          8fc9d1b8 81473567 00000800 00000795 8720a000 ffffffb3 813e0b60 81385130
          00000800 81029438 00000000 00000000 8141afa8 871adc94 871adc94 81419268
          00000800 00000000 00000000 00000000 00000000 00000000 00000000 00000000
          00000000 00000000 00000000 00000000 00000000 00000000 00000000 871adc28
          ...
Call Trace:
[<81009a10>] show_stack+0x64/0x7c
[<812901c4>] ubi_io_read+0x210/0x3d0
[<81290870>] ubi_io_read_vid_hdr+0x68/0x260
[<81295980>] ubi_attach+0x228/0x1538
[<8128a020>] ubi_attach_mtd_dev+0x604/0xd44
[<8128aa24>] ctrl_cdev_ioctl+0xf4/0x18c
[<810d73c8>] do_vfs_ioctl+0xa4/0x680
[<810d7a44>] SyS_ioctl+0xa0/0xac
[<8100ec10>] stack_done+0x20/0x40

UBI: scanning is finished
UBI: attached mtd7 (name "RootFS", size 247 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 1981, bad PEBs: 1, corrupted PEBs: 0
UBI: user volume: 0, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 9/7, WL threshold: 4096, image sequence number: 278018786
UBI: available PEBs: 1938, total reserved PEBs: 43, PEBs reserved for bad PEB handling: 39
UBI: background thread "ubi_bgt0d" started, PID 106
UBI device number 0, total 1981 LEBs (251539456 bytes, 239.9 MiB), available 1938 LEBs (246079488 bytes, 234.7 MiB), LEB size 126976 bytes (124.0 KiB)
+ progress 4
+ echo 4
4
+ ubimkvol /dev/ubi0 -N troot -m
Set volume size to 246079488
Volume ID 0, size 1938 LEBs (246079488 bytes, 234.7 MiB), LEB size 126976 bytes (124.0 KiB), UBIFS: default file-system created
dynamic, name "tUBIFS: background thread "ubifs_bgt0_0" started, PID 109
root", alignment 1
+ progress 5
+ echo 5
5
+ mount -t ubifs ubi0:troot /mnt
UBIFS: mounted UBI device 0, volume 0, name "troot"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 244428800 bytes (233 MiB, 1925 LEBs), journal size 12189696 bytes (11 MiB, 96 LEBs)
UBIFS: reserved for root: 4952683 bytes (4836 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID 67AF1A36-3CB5-4EBA-BBF4-BE52116C2E81, small LPT model
+ cd /mnt
+ progress 6
+ echo 6
6
+ tar xf /srv/upgrade.tar squashfs.tmp squashfs.tmp.md5 version.tmp

Anybody got an idea why OpenWRT can't perform ubiformat and ubiattach properly while Ubiquiti recovery/firmware still can? Imagine it's either different partition layout, or something with ubiformat/ubiattach binaries?

Did you manage to resolve this. I've got something similar. First part worked ok, loading the second OpenWRT image didn't work. Stuck in the bootloader now.

My only solution was to use the Ubiquiti Recovery image.
Mind there are two for thos model, and one did work to get it back up with an working firmware. I don't remember which one it was, was either one of these which I noticed both are still on my TFTP server:

ER-e50.recovery.v1.10.10.5210345.190714.1127.16de5fdde
ER-e50.recovery.v2.0.6.5208541.190708.0508.16de5fdde

So, from boot loader, set image load from TFTP and point to your set-up TFTP server where these files are located. You will need to use serial console for this to work.