[Hardware Hacking General] osm0sis:
Ah yes, mine does have the a9 clk max value too, just like yours, I just didn't notice it since it's actually part of the nandargs= variable, even without that extra build.prop line. Here it is cleaned up.

/dev/nand_env:

p^⌠τ
batfull_threshold=98
batlow_threshold=10
baudrate=115200
bootargs=root=/dev/cardblksd2 rw rootfstype=ext3 rootwait init=/init console=ttyS0,115200n8 nohlt vmalloc=256m mem=1024m logo=osd1,0x84100000,720p
bootcmd=run nandboot
bootdelay=1
bootfile=boot.img
chipname=8726m6
console=ttyS2,115200n8
cvbscheck=
setenv outputtemp ${outputmode};
if test ${outputmode} = 480i; then
if test ${cvbsenable} = true; then
setenv outputtemp 480cvbs;
fi;
fi;
if test ${outputmode} = 576i; then
if test ${cvbsenable} = true; then
setenv outputtemp 576cvbs;
fi;
fi
cvbsenable=false
display_bpp=24
display_color_bg=0
display_color_fg=0xffff
display_color_format_index=24
display_height=480
display_layer=osd1
display_width=720
ethaddr=c4:4e:ac:02:45:67
fb_addr=0x84900000
gatewayip=10.18.9.1
hostname=arm_m6
ipaddr=10.18.9.97
loadaddr=0x82000000
loadaddr_misc=0x83000000
machid=4e27
mmcargs=setenv bootargs console=${console} boardname=m6_mbx
nandargs=
run cvbscheck;
nand read aml_logo 0x84100000 0 400000;
setenv bootargs root=/dev/cardblksd2 rw rootfstype=ext3 rootwait init=/init console=ttyS0,115200n8 mac=${ethaddr} logo=osd1,0x84100000,${outputtemp},full androidboot.resolution=${outputmode} nohlt vmalloc=256m mem=1024m a9_clk_max=1512000000 nandboot=echo Booting from nand ...;
run nandargs;
nandread boot ${loadaddr} 0 600000;
hdcp prefetch nand;
bootm;
run recovery
netmask=255.255.255.0
outputmode=576p
outputtemp=720p
preboot=
get_rebootmode;
clear_rebootmode;
echo reboot_mode=${reboot_mode};
if test ${reboot_mode} = usb_burning; then
tiny_usbtool 20000;
fi;
run upgrade_check;
run updatekey_or_not;
run switch_bootmode
reboot_mode=charging
recovery=echo enter recovery;
run nandargs;
if mmcinfo; then
if fatload mmc 0 ${loadaddr} recovery.img; then
bootm;
fi;
fi;
nand read recovery ${loadaddr} 0 600000;
bootm serverip=10.18.9.113
sleep_threshold=20
switch_bootmode=
if test ${reboot_mode} = factory_reset; then
run recovery;
else
if test ${reboot_mode} = update; then
run recovery;
fi;
fi
testaddr=0x82400000
update=
if mmcinfo; then
if fatload mmc 0 ${loadaddr} aml_autoscript; then
autoscr ${loadaddr};
fi;
fi;
run recovery
updatekey_or_not=
saradc open 4;
if saradc get_in_range 0x0 0x50; then
msleep 500;
if saradc get_in_range 0x0 0x50; then
run update;
fi;
fi
upgrade_check=
if itest ${upgrade_step} == 1; then
defenv_without reboot_mode;
setenv upgrade_step 2;
save;
fi
upgrade_step=2
usbnet_devaddr=00:15:18:01:81:31usbnet_hostddr=00:15:18:01:a1:3bcdc_connect_timeout=9999999999
usbtty=cdc_acm
video_dev=tvout cvbsmode=480cvbs has.accelerometer=0 digitaudiooutput=PCM 576poutputx=36 576poutputy=34 576poutputwidth=628 576poutputheight=514

Interesting little bits of script they have in there. I wonder if there's any way to get back to the nand prompt to enter some of them..

Now, the odd thing is that doing that cat or trying to cat /dev/nand_env > /sdcard/nand_env.txt or doing a nanddump to /sdcard with the package I already have seems to freeze my device. Is it required that you nanddump out to external storage since the nand is in use?

Also weird is that I have the latest stericson BusyBox smart installed but I don't see nanddump in the Applet List or /system/xbin/..

Edit: never mind, found it in the binary, it just isn't symlinked or mentioned in the installer app. ;)

That area of the bootlog where it accesses memory locations for clk target lock and so on IS rather interesting... I'd be afraid to brick my device though! :p