Hi all, I'm trying to use urjtag to erase, then flash to this setup (below). Sorry, tjtag output follows - I could never make urjtag properly recognize the processor, so no print command is available to me in urjtag .

Anyway, the erase does apprear to complete all 35 blocks of this 2MB chip but when I try to dump its content and look at it with a hex editor, I see 0xF7FF on most BUT NOT ALL addresses. Some block and sometimes just individual addresses do have  the 0xFFFF that I'm expecting.

What do you think could be causing it and how to remedy it?

So, below is that hardware printout. The cable is unfuffered dlc5.

D:\Documents and Settings\Electronics\DD-WRT\tjtagv2-1-4\windows>tjtagv2 -probeo
nly /noreset /nobreak
 EJTAG Debrick Utility v2.1.4-Tornado-MOD
Probing bus ... Done
Instruction Length set to 8
CPU Chip ID: 00000101001101010010000101111111 (0535217F)
*** Found a Broadcom BCM5352 Rev 1 CPU chip ***
    - EJTAG IMPCODE ....... : 00000000100000000000100100000100 (00800904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS32
Issuing Processor / Peripheral Reset ... Skipped
Enabling Memory Writes ... Done
Halting Processor ... Skipped
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... Done
Flash Vendor ID: 00000000000000000000000000100000 (00000020)
Flash Device ID: 00000000000000000010001011000100 (000022C4)
*** Found a ST M29W160ET 1Mx16 TopB    (2MB) Flash Chip ***
    - Flash Chip Window Start .... : 1fc00000
    - Flash Chip Window Length ... : 00200000
    - Selected Area Start ........ : 00000000
    - Selected Area Length ....... : 00000000