What I am running is vmware + ubuntu 8.04.

First I telnet to the dm500 from ubuntu terminal
then I make directory
root@dm500 ~ #mkdir /var/tmp/root
root@dm500 ~ #mount -t squashfs -o ro /dev/mtdblock/5 /var/tmp/root
root@dm500 ~#cd /var/tmp
root@dm500 /tmp #tar -cf root.tar root
root@dm500 /tmp #
then I open another terminal to ftp to dm500
root@ubuntu8041:/home/user/Desktop# ftp 192.168.0.112
Connected to 192.168.0.112.
220 Welcome to the PLi dreambox FTP server
Name (192.168.0.112:user): root
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd /tmp
250 Directory successfully changed.
ftp> get root.tar
ftp>bye
root@ubuntu8041:/home/user/Desktop# tar -xf root.tar
root@ubuntu8041:/home/user/Desktop# ./mksquashfs root mtd5.img
I mksquashfs back the original root and a new mtd5.img is created.
then I ftp back to dm500
root@ubuntu8041:/home/user/Desktop# ftp 192.168.0.112
Connected to 192.168.0.112.
220 Welcome to the PLi dreambox FTP server
Name (192.168.0.112:user): root
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd /tmp
250 Directory successfully changed.
ftp> put mtd5.img
ftp>bye
exit back to Desktop and telnet back to the box
i change the directory to /tmp
root@ubuntu8041:/home/user/Desktop# telnet 192.168.0.112
Trying 192.168.0.112...
Connected to 192.168.0.112.
Escape character is '^]'.

PLi dm500 Jade 20080718 (based on 1.09)
welcome on your dreambox! - Kernel 2.6.9 (13:08:41).
dm500 login: root
Password:


BusyBox v1.01 (2008.07.11-10:44+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

root@dm500 ~ # cd /tmp && eraseall /dev/mtd/5 && cp mtd5.img /dev/mtd/5 && reboot

after image flashed dm500 reboot but dm500 is dead

I did not umount the root directory in the /var/tmp nor I have deleted the root.tar

Have I done anything wrong?