first suppose that you use yaffs inband mode ; yaffs2_CheckpointFindNextCheckpointBlock get a buffer for read , the buffer 's content maybe YAFFS_SEQUENCE_CHECKPOINT_DATA, but the block is a * bad *block , so the buffer 's content donot changed after read, so yaffs2_CheckpointFindNextCheckpointBlock found a "*checkpoint *block"; I think the yaffs2_CheckpointFindNextCheckpointBlock should add bad block detect;