NBD has a so simple protocol, hard to get it wrong. A short note for those who dare to try it out: The 4th partition is the user store *but* it is laid out as a full device, i.e. it has a partition table prepended. They did it to export the 4th partition via USB and it would present as a new "full" device with one partition.
That is implemented in /etc/init.d/userstore in the root file system. It checks the partition table within the partition and if it is invalid / zero, the user store will be reformatted. This is the reformatting taking place when you write some zeroes to the start of the userstore. If you want to mount the userstore, you need to specify an offset, just as /etc/init.d/userstore does. On my kindle, the actual partition (within the 4th partition of the flash device) starts at offset=8192. The command to mount it would be
Code:
root# mount -o offset=8192 /dev/nbd0p4 /mnt/kindle-userstore