Did you ever find a way to read the existing EEPROM (not firmware) from a good 9024D-M?
Asking because I found this when logged into mine:
# pwd
/usr/mst/bin
# ls -la
drwxrwxr-x 2 root root 1024 Nov 10 2008 .
drwxrwxr-x 3 root root 1024 Nov 10 2008 ..
-rwxrwxr-x 1 root root 76948 Nov 10 2008 eburn
-rwxrwxr-x 1 root root 24673 Nov 10 2008 i2c
-rwxrwxr-x 1 root root 17519 Nov 10 2008 mread
-rwxrwxr-x 1 root root 25001 Nov 10 2008 mtserver
-rwxrwxr-x 1 root root 17547 Nov 10 2008 mwrite
# ./eburn
EBURN - Command line EEPROM burning tool
Usage:
/usr/mst/bin/eburn <EEPROM_image_file> [options...]
Options:
-h - Print this message
-s - Silent mode - do not print progress
-v - Verify only, do not burn
-d <DEBUG_LEVEL> - Debug level 0, 1, 2. Default is 0 (none)
-sysguid <SYS_GUID> - Update system guid
-nodeguid <NODE_GUID> - Update node guid
-L - Lock i2c semaphor
-R - Route i2c open (used only for ISR9024 flavors)
-W - WriteProtect remove (used only for ISR9024-SM/DM)
-dev <DEV> - Burn using dev
-lid <LID> - Burn using lid
-self_burning - Use this flag only for ISR9024 self burning
-LidA1 - Lid used for advanced test - this is must option
-ForceA1 - Halt advanced Test:
1) test - firmware higher than 1.0.0 could be burn only on A1 chip
2) check with vendorMAD the chip version , INI version, BoardType
That looks like it will burn an EEPROM image to a remote 9024D-M, in-band. Which I think would solve your problem.
Now, if we can just get a working EEPROM file...
(yes, I am very persistent)