How do I attache an mdt device to ubi?

So obviously ubiattach is the way to go. My real questions is "what are the consequences of doing so?".

Vanilla available disk space on my Netgear WAX202.

root@OpenWRT:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 4.0M      4.0M         0 100% /rom
tmpfs                   248.9M      1.2M    247.8M   0% /tmp
/dev/ubi0_1              22.3M      7.5M     13.6M  36% /overlay
overlayfs:/overlay       22.3M      7.5M     13.6M  36% /
tmpfs                   512.0K         0    512.0K   0% /dev

All raw block devices:

root@OpenWRT:~# lsblk
NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
mtdblock0    31:0    0  512K  1 disk 
mtdblock1    31:1    0  512K  1 disk 
mtdblock2    31:2    0  512K  1 disk 
mtdblock3    31:3    0   38M  0 disk 
mtdblock4    31:4    0    4M  0 disk 
mtdblock5    31:5    0   34M  0 disk 
mtdblock6    31:6    0   38M  1 disk 
mtdblock7    31:7    0    8M  1 disk 
mtdblock8    31:8    0    4M  1 disk 
mtdblock9    31:9    0    1M  1 disk 
mtdblock10   31:10   0    4M  1 disk 
mtdblock11   31:11   0    2M  1 disk 
mtdblock12   31:12   0    1M  1 disk 
mtdblock13   31:13   0    1M  1 disk 
mtdblock14   31:14   0    5M  1 disk 
mtdblock15   31:15   0    1M  1 disk 
mtdblock16   31:16   0  6.3M  1 disk 
ubiblock0_0 254:0    0    4M  0 disk /rom

If I add up the /dev/mtdblock*, I get 148, which is close to the 128M reported on the device page.

I looks like only /dev/mdtblock5 is attached to ubi (Is there really no ubi* command to show this?)

root@OpenWRT:~# cat /sys/devices/virtual/ubi/ubi0/mtd_num
5

Assuming a bit of overhead, that looks to about match the UBI config:

root@OpenWRT:~# ubinfo -a
UBI version:                    1
Count of UBI devices:           1
UBI control device major/minor: 10:62
Present UBI devices:            ubi0

ubi0
Volumes count:                           2
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     272 (34537472 bytes, 32.9 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  20
Current maximum erase counter value:     3
Minimum input/output unit size:          2048 bytes
Character device major/minor:            250:0
Present volumes:                         0, 1

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        33 LEBs (4190208 bytes, 3.9 MiB)
State:       OK
Name:        rootfs
Character device major/minor: 250:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        215 LEBs (27299840 bytes, 26.0 MiB)
State:       OK
Name:        rootfs_data
Character device major/minor: 250:2

Can I just ubiattach -p /dev/mtdblock3 and possibly all the other mtd devices to get my 128M of disk space? I assume not. I think at least one of those devices is used for firmware upgrades and rollbacks and such. Is there any way to figure out which one and use the rest?

See here for the partition table of your device: https://github.com/openwrt/openwrt/blob/3c31f6b521bb5fc49e222a8f2bcd454b73452a0e/target/linux/ramips/dts/mt7621_netgear_wax202.dts#L110

As you can see, all other partitions seem to serve a purpose. I don't know about the firmware_backup partition, is this a dual-firmware device? If yes, you could use that space as well. I would compile my own firmware image and change the partition map. Please keep in mind that this might prevent your device from booting, I'm not familiar with this device.

All other partitions are marked as read-only, so you can't use them anyway.