[Motorola Droid RAZR] whirleyes:
I'm answering my own question (of course, for future reference), based on my experience of 10 hours~ spend in the dark side of razr fastboot.

Findings

Q: What partition hold the partition table?

A: ebr partition.

xt910 ebr (preinstall 10mb, userdata 3.9gb, system 780mb, emstorage 9gb)

xt912 ebr (preinstall 600mb, userdata 3.0gb, system 600mb, emstorage 8gb)

Here's the catch, if you change ebr, you also must change the cdt.bin partition. Because, the bootloader read cdt.bin to find the address of security certificate for each partition. (different partition length -> different security location offset)

For now, it is being said that cdt.bin can't be downgrade, it only can be flashed with same or newer version.

Coincidence

Few months ago, I discovered that xt909 cid is same like china xt910. With the ICS leaks, both phone cdt.bin were upgraded to 4. At that time, I figured out that I can easily switch between xt910 kernel & xt909 kernel without any side effect. (It is also known that we can bypass region check by erasing cid partition, but that comes with a side effect of booting by bp-tools)

Last month, xt909 got a 2nd ICS OTA. After looking at the contents, I found out that that update will upgrade my cdt.bin to ver 5. Lucky for me, I refuse to upgrade my cdt.bin & do offline patching for OTA upgrade. So my cdt.bin is stays at 4 (current cdt.bin for xt909 is 5, while xt910 is 4 & xt912 is 3). With this, I can hybrid my phone with some china xt910 fastboot files to recover it from brick.

Fear of brick no-more.

For once & for all, I solved my problem my of "no leaked fastboot for xt909". Now I can restore my phone from soft-brick just within 15 minutes, with no side effect of bp-tools at all.

The end result

Here's what my phone internal partition looks now.

ebr - xt910 (I prefer xt910 partition table, got bigger userdata & emstorage)

cdt.bin -xt910

system - xt910 (I restored my backup of xt909 ROM onto of it)

boot - xt909

devtree - xt909

recovery - xt909

cid - restored with my own backup. No Customer ID error

bp.img -xt909 (can be swapped with xt912 bp.img for GSM function)

Development of BootMenuManager

Maybe some of you have heard of the rumors of Safestrap 3. I think it will be a big change. Thing I like is the changes of the sd mount point. Keep ROM into internal storage, personal data to external sdcard (music,pics & etc)

Seriously, there's no really big ROM development happen in Razr except from STS-dev team & it's derivative works. Having no choice, BootMenuManager need to follow their changes.

With the spirit of Mr Cyanogen, I'm trying to deliver a creative, unique & original features of alternative while keeping the compatibility with Hashcode's Safestrap.

Here I'm asking what features do you like to have in next version of BootMenuManager? My thinking :

+ Change the official name to BootMenuManager (to resolve name conflict with CyanogenMod bootmenu)

+ Stop using preinstall partition, BootMenuManager stays in 1st-system partition (Preparation to move away from Motorola system)

+ 2nd,3rd&etc data,system&cache is stored in a storage pools (make from any available partition, hopefully I can compile a unionfs/aufs kernel module)

+ No more separate download of package. I'm done with counting unique download. A single apk is easier to handle.

+ Minimal ROM patching/hopefully none. (Must wait for the release of Safestrap 3 ROM before changing strategy)

+ Recovery : stays with latest CWM + BMM enhancement. Auto install bootmenu apk after a ROM install.