You said you had a NAND dump?
If so, share it with us to have a look.
Yes, I have a full dump including the OOB data but after the firmware is corrupted. so the bootloader section OOB is useless.
Also, the other dumps I got from the other working scope don't include OOB data and unfortunately, I bricked that scope as well
because I had no Idea the "nandtest" command messes up the block content.
here is the full dump including OOB after bootloader being messed up
https://mega.nz/file/EwhBHK5Z#iWaQYef7AYeb_-1wFezzOjsCgKbDqYcK72qOQfp7sz4as you can see on page 65472 and 65408 there is the BBT according to Zynq documents (in the last 4 blocks)
also, I have a boot log that points to them as well
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
according to Micron ECC the OOB area is 64 bytes and the table explains each part. however, that table (should?) be valid only when the internal ECC is used. It seems the Zynq uses address 0x804 - 0x807 to store the BBT signature (spare 0) and address 0x808 - 0x80F are the calculated ECC parity bits based on the content of main0 and spare 0 the subsequent addresses are similar.
to sum it up, the last 8 bytes in each row are the parity bits, the first 8 bytes of each row are the Bad block information (2 bytes) + 6 byte user data (from that 6 bytes 2 bytes are not ECC protected (User metadata II) and 4 bytes are ECC protected (user metadata I))