OK - that's should be still within acceptable developer implementation. So - basically - there are no not used blocks not marked as defective present in the dumps, correct?
So in another words - all the blocks in both chips are ALWAYS marked as (Samsung)defective.
I suppose this patterns is NOT present in not used blocks? Then it would be simply $ony's proprietary implementation of used bocks.
Also - are there any other data present in spare bytes area apart of those for 0x00 ones??
This contradicts a bit (unless I'm missing some aspect of your deductions) your other findings above. I would expect more that those spare bytes are marking for used blocks (indeed ONLY if you can confirm that that they're NOT present in unused / all 0xFF blocks).
Sorry for "repeating" some of your finding just in another words - it helps me to make more clear picture of the whole situation.
I was indeed thinking exactly the same but I would also expect that chips are "shipped" with all really faulty blocks already pre-marked by Samsung and then later on during the implementation by $ony (all??) other non-defective blocks are marked as defective too (to confuse / complicate the reverse engineering?).