I've been testing out the MTD driver.
Minimal testing has uncovered an issue in that reading from /dev/mtd7 (the host PNOR) is unreliable.
$ dd if=/dev/mtd7 of=/tmp/pnor count=1
Appears to work, what looks like an FFS header is in /tmp/pnor. Repeating that command reads all FF.

Didn't reproduce on /dev/mtd0.