[SOLVED] ZBT-Z8103AX / MT7981 – UBI attach failure after sysupgrade

Installing and Using OpenWrt
1

After flashing OpenWrt on my ZBT-Z8103AX (MT7981), I repeatedly got:

ubi0: vtbl_check: too large reserved_pebs 878, good PEBs 512
UBI error: cannot attach mtd6, error -22

UBI thought the flash had more blocks than it actually did. This was not a bad NAND issue — it was caused by a mismatch in the device tree (DTS) between what I used to format NAND and what the system used at boot.

Root Cause

  • U-Boot’s DTB defined:

    reg = <0x580000 0x3a80000>; // ~58 MiB UBI region

  • My OpenWrt DTS initially didn’t match: I had lowercase partition names (bl2, fip, factory) instead of the uppercase names U-Boot used (BL2, FIP, Factory). This led to duplicate MTD entries and confusion during early boots.

  • The initramfs image (TFTP) I used for recovery used a generic MT7981 DTS with a much larger 122 MiB ubi region (reg = <0x580000 0x7a80000>).

  • When I ran ubiformat from that mismatched RAM image, it wrote UBI headers expecting 878 PEBs.

  • On reboot, U-Boot and the sysupgrade kernel (both using the correct 58 MiB layout) saw the mismatch and refused to attach.

Additionally, I initially tried to recover via the ZBT failsafe web UI, but it couldn’t properly flash a working image — it reused the same broken layout. The only reliable path was to use TFTP + serial.

Fix

I rebuilt the DTS so that:

  • Partition names match U-Boot’s (e.g., bl2, fip, factory, ubi). Though I am not sure the case is important. Would love to hear from other people.
  • The UBI partition size is 0x3A80000 (58 MiB) to match U-Boot’s geometry.

Then I rebuilt the initramfs (TFTP) image using this same DTS.

From that matching environment:

ubidetach -p /dev/mtd4 || true
flash_erase /dev/mtd4 0 0
ubiformat /dev/mtd4 -y -O 2048
sysupgrade -n /tmp/openwrt-mediatek-mt7981-zbt-z8103ax-squashfs-sysupgrade.bin

After reboot, UBI attached cleanly:

ubi0: attached mtd4 (ubi), size 58 MiB
ubi0: good PEBs: 512
UBI: mounted ubi0:rootfs

Lessons Learned

  • Consistent DTS: The kernel used for formatting (TFTP/initramfs) must have the same partition layout as the one used at boot.
  • Partition names matter: Case differences (bl2 vs BL2) can create duplicate or ghost MTDs.
  • Failsafe web UI isn’t reliable for this board—it may reuse broken UBI geometry. Use TFTP + serial console for full control.

Once the DTS and U-Boot partition tables matched exactly, UBI attached immediately and the router booted from NAND without issue.