[Nexus 9 Q&A, Help & Troubleshooting] playahate:
My thoughts:

The quote is taken from android.googlesource.com:

So this line:

adb shell busybox fdisk /dev/block/mmcblk0

Gives us:

Number Start (sector) End (sector) Size Code Name
1 256 229631 224K 0700 modem
2 229632 262399 32768 0700 metadata
3 262400 263167 768 0700 sbl1
4 263424 263535 112 0700 sdi
5 263936 263967 32 0700 sec
6 263968 264031 64 0700 ddr
7 264192 266239 2048 0700 aboot
8 267192 267703 512 0700 rpm
9 268192 269215 1024 0700 utags
10 269216 270215 1000 0700 tz
11 270216 278527 8312 0700 padA
12 278528 279295 768 0700 sbl1bak
13 279552 281599 2048 0700 abootBackup
14 282552 283063 512 0700 rpmBackup
15 283552 284575 1024 0700 utagsBackup
16 284576 285575 1000 0700 tzBackup
17 285576 285583 8 0700 versions
18 285696 286719 1024 0700 frp
19 286720 288767 2048 0700 mdm1m9kefs1
20 288768 290815 2048 0700 mdm1m9kefs2
21 290816 292863 2048 0700 mdm1m9kefs3
22 292864 294911 2048 0700 padB
23 294912 327679 32768 0700 sp
24 327680 360447 32768 0700 keystore
25 360448 364543 4096 0700 logs
26 364544 430079 65536 0700 persist
27 430080 430591 512 0700 mdm1hob
28 430592 430655 64 0700 mdm1dhob
29 430656 430911 256 0700 cid
30 430912 447295 16384 0700 logo
31 447296 449343 2048 0700 misc
32 449344 454399 5056 0700 padD
33 454400 454401 2 0700 mdm1m9kefsc
34 454402 454417 16 0700 ssd
35 454656 487455 32800 0700 recovery
36 487680 505855 18176 0700 kpan
37 505856 538623 32768 0700 boot
38 538624 1062911 512K 0700 cache
39 1062912 1193983 128K 0700 oem
40 1193984 1196031 2048 0700 padC
41 1196032 5390335 4096K 0700 system
42 5390336 61005567 53.0M 0700 userdata

It could be (or could not be) mmcblk0p5 partition as its only 32 bytes and must contain only 1 or 0 for "enable oem unlock"... (the name is sec=secure?)

Dunno if its possible to flash the img from the device with enabled feature. As it states in another thread - users on 5.1 get this slider/checkbox get "off" after every reboot (though the bootloader stays unlocked if it was performed already). So it must be set to "enable" then the device must be rebooted to bootloader to make fastboot oem unlock. And if after enabling it, you reboot into recovery to get adb working, or boot the fastboot and then without unlocking boot to system - the trigger gets back to "off". So the fastboot definetly checks the value in that partition.

Actually theres 3 ways:

1. The trigger is set to "on" in system and writes to the partition immediatly. GOOD. We can make backup on some device, then push the .img to our device and restore backup while in recovery with smth like (in case its p5, i dunno whether its true): UPD: the Nexus 6 build.prop has ro.frp.pst=/dev/block/platform/msm_sdcc.1/by-name/frp, so the needed partition is 18

Then reboot into fastboot and make unlock.

Of course it will work only if you made unlock before, flashed the TWRP and relocked the bootloader.

2. The trigger is set to "on" in system and writes to the partition only after reboot. Reboot to recovery still get the same value is "on". GOOD. We can make backup on some device while in recovery, then push the .img to our device and restore backup while in recovery

3. The trigger is set to "on" in system and writes to the partition only after reboot into bootloader. Reboot to recovery rewrites the partition and it becomes "off". BAD. We can't do anything.

UPDATE:

Another option is to try to get into second bootloader (aboot). On the Nexus 5 its VolUP+VolDown+Power from the "Switched Off" Device. And if you plug the device to PC (with the proper installed drivers) - the adb must work and all the commands including the mentioned one (dd if=/dev/block/mmcblk0p18 of=/sdcard/name_of_backup.img).

The main problem is - it seem to be available ONLY if the main bootloader is corrupted and the phone doesn't boot into bootloader. But its worth trying...