When your player is in the bricked state, can you dump the first 32MB of the exposed raw disk? That should contain the flashed bin + bootloader. From what you said, it sounds like that does not get properly written by your player for some reason (perhaps different hardware revision?). It would be interesting to see what ends up there instead of the rockbox bootloader when the player is 'bricked'.