So I would go this way:
1. read ROM
2. if FIPS is ok: DRAM is broken - replace DRAM, or find a working PCB and put the ROM on it
With command "DL" I dumped 128kByte several times and compared the results:
between two power-cycles the contents are always the same.
After a power-cycle only some specific bits in these areas are changing:
0x1c860 - 0x1c9df
0x1cfe0 - 0x1d1ff
0x1e880 - end
For example: addresses 0x1c860, 0x1c8e0 and 0x1c960 read 5 times (read, power-cycle, read, power-cycle, ...):
Code:
L:0001C860 00320032 00320032 EB9151EF 15668C89
L:0001C860 00320032 00320032 EF1141EE 15668489
L:0001C860 00320032 00320032 EB115166 1D668489
L:0001C860 00320032 00320032 EF1151EE 0566CC89
L:0001C860 00320032 00320032 EB11516E 15668C89
Code:
L:0001C8E0 D06A4376 D0CC6F22 6C93D1E0 448934F7
L:0001C8E0 D06A417E D48C4F22 6C1BC1E0 448930FF
L:0001C8E0 506A457E D4C44F22 6C97D1E0 448934F7
L:0001C8E0 D062417E D1CC6F22 6C13D1E0 54C934FF
L:0001C8E0 50624176 D1C44F22 6C13D1E0 448934FF
Code:
L:0001C960 8BAA14F1 E4ED9E24 D39C76EE 4D2DB54B
L:0001C960 9BAA16F0 A4ED9E24 F39D7666 5C2DB14F
L:0001C960 9BAA14E0 A4ED8E24 D38A76EC 5D2DB54B
L:0001C960 8BAA14F0 E4ED9E24 F39C766E 4D2DB14B
L:0001C960 9BAA14F0 E4ED9E24 F39D766C 4D2DB54F
For me it looks like bad memory cells - is it Flash or DRAM?