ZyXEL OEM firmware, version "V1.00(ABCS.2)C0":
header (/dev/mmcblk0p3):
# cat /dev/mmcblk0p3 | hexdump -C | head -n 5
00000000 00 00 a7 74 01 32 f0 00 56 31 2e 30 30 28 41 42 |...t.2..V1.00(AB|
00000010 43 53 2e 32 29 43 30 00 ff ff ff ff ff ff ff ff |CS.2)C0.........|
00000020 ff ff ff ff ff ff ff ff 00 00 d5 dc 4e 42 47 36 |............NBG6|
00000030 38 31 37 00 ff ff ff ff ff ff ff ff ff ff ff ff |817.............|
00000040 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
# dd if=/dev/mmcblk0p3 bs=1 skip=8 count=16 2>/dev/null
V1.00(ABCS.2)C0
kernel (/dev/mmcblk0p4):
# cat /dev/mmcblk0p4 | hexdump -C | head -n 5
00000000 27 05 19 56 30 17 e6 cf 57 9b 19 4c 00 1c 6a 58 |'..V0...W..L..jX|
00000010 41 50 80 00 41 50 80 00 c4 29 7c 36 05 02 02 00 |AP..AP...)|6....|
00000020 4c 69 6e 75 78 2d 33 2e 34 2e 31 30 33 00 00 00 |Linux-3.4.103...|
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000040 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 |................|
# dd if=/dev/mmcblk0p4 bs=1 skip=32 count=25 2>/dev/null
Linux-3.4.103
rootfs (/dev/mmcblk0p5):
<this contains rootfs, the OEM overlay is on /dev/mmcblk0p1 (rootfs_data)>
ZyXEL OEM firmware, version "V1.00(ABCS.5)C0":
header_1:
# cat /dev/mmcblk0p6 | hexdump -C | head -n 5
00000000 00 00 bf 94 01 46 d8 00 56 31 2e 30 30 28 41 42 |.....F..V1.00(AB|
00000010 43 53 2e 35 29 43 30 00 ff ff ff ff ff ff ff ff |CS.5)C0.........|
00000020 ff ff ff ff ff ff ff ff 00 00 d6 5a 4e 42 47 36 |...........ZNBG6|
00000030 38 31 37 00 ff ff ff ff ff ff ff ff ff ff ff ff |817.............|
00000040 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
# dd if=/dev/mmcblk0p6 bs=1 skip=8 count=16 2>/dev/null
V1.00(ABCS.5)C0
kernel_1:
# cat /dev/mmcblk0p7 | hexdump -C | head -n 5
00000000 27 05 19 56 6a 19 f0 c0 58 dc e4 a7 00 1c 56 20 |'..Vj...X.....V |
00000010 41 50 80 00 41 50 80 00 71 34 fe 9c 05 02 02 00 |AP..AP..q4......|
00000020 4c 69 6e 75 78 2d 33 2e 34 2e 31 30 33 00 00 00 |Linux-3.4.103...|
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000040 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 |................|
# dd if=/dev/mmcblk0p7 bs=1 skip=32 count=25 2>/dev/null
Linux-3.4.103
rootfs_1 (/dev/mmcblk0p8):
<this contains rootfs, the OEM overlay is on /dev/mmcblk0p1 (rootfs_data)>
LEDE/ master:
header (/dev/mmcblk0p3):
not yet updated by LEDE, so whatever was previously left there by an OEM firmware
kernel (/dev/mmcblk0p4):
# cat /dev/mmcblk0p4 | hexdump -C | head -n 5
00000000 27 05 19 56 67 c0 a3 ba 5a 2b 05 67 00 1e e5 fe |'..Vg...Z+.g....|
00000010 42 20 80 00 42 20 80 00 cf 2d f2 d2 05 02 02 00 |B ..B ...-......|
00000020 41 52 4d 20 4f 70 65 6e 57 72 74 20 4c 69 6e 75 |ARM OpenWrt Linu|
00000030 78 2d 34 2e 39 2e 36 37 00 00 00 00 00 00 00 00 |x-4.9.67........|
00000040 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 |................|
# dd if=/dev/mmcblk0p4 bs=1 skip=32 count=25 2>/dev/null
ARM OpenWrt Linux-4.9.67
rootfs (/dev/mmcblk0p5):
<this contains rootfs and overlay>
Difference between LEDE/ release (prior to rebranding back to OpenWrt):
$ wget -qO- https://downloads.lede-project.org/releases/17.01.4/targets/ipq806x/generic/lede-17.01.4-ipq806x-NBG6817-squashfs-mmcblk0p4-kernel.bin | hexdump -C | head -n 5
00000000 27 05 19 56 ec f1 4c e3 59 e6 41 ec 00 1c 71 81 |'..V..L.Y.A...q.|
00000010 42 20 80 00 42 20 80 00 15 fd a6 c5 05 02 02 00 |B ..B ..........|
00000020 41 52 4d 20 4c 45 44 45 20 4c 69 6e 75 78 2d 34 |ARM LEDE Linux-4|
00000030 2e 34 2e 39 32 00 00 00 00 00 00 00 00 00 00 00 |.4.92...........|
00000040 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 |................|
$ wget -qO- https://downloads.lede-project.org/releases/17.01.4/targets/ipq806x/generic/lede-17.01.4-ipq806x-NBG6817-squashfs-mmcblk0p4-kernel.bin | dd bs=1 skip=32 count=25 2>/dev/null
ARM LEDE Linux-4.4.92
and current LEDE master (post rebranding back to OpenWrt):
$ wget -qO- https://downloads.lede-project.org/snapshots/targets/ipq806x/generic/openwrt-ipq806x-NBG6817-squashfs-mmcblk0p4-kernel.bin | hexdump -C | head -n 5
00000000 27 05 19 56 d0 2f aa f9 5a 3d 41 53 00 1f 5a f6 |'..V./..Z=AS..Z.|
00000010 42 20 80 00 42 20 80 00 68 04 c4 25 05 02 02 00 |B ..B ..h..%....|
00000020 41 52 4d 20 4f 70 65 6e 57 72 74 20 4c 69 6e 75 |ARM OpenWrt Linu|
00000030 78 2d 34 2e 39 2e 37 30 00 00 00 00 00 00 00 00 |x-4.9.70........|
00000040 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 00 00 a0 e1 |................|
$ wget -qO- https://downloads.lede-project.org/snapshots/targets/ipq806x-NBG6817-squashfs-mmcblk0p4-kernel.bin | dd bs=1 skip=32 count=25 2>/dev/null
ARM OpenWrt Linux-4.9.70
Kernel and rootfs (and therefore label/ kernel version) are only stored on the eMMC (/dev/mmcblk0), which has a normal GPT partition table - accordingly the partitioning is identical between the OEM firmware and LEDE. Nothing firmware version specific ever touches the SPI-NOR, it's all contained within the eMMC.
What does differ is the partitioning of the SPI-NOR flash, this makes the numbering of the mtd partitions slightly volatile. Both LEDE and the OEM firmware only use the mtd label via find_mtd_part() from /lib/functions.sh; unfortunately this label also differs between OEM ("dualflag") and LEDE ("0:DUAL_FLAG"). This bootflag is the only data that 'ever' gets modified on the SPI-NOR flash.
I've detailed the partitioning for SPI-NOR and eMMC under LEDE and the OEM firmware as well.