My work on this is paused and is at https://github.com/xloem/backyard_mediatek_flasher , where the relevent commands are noted as comments in test.py as I reviewed strace logs.

The next step is probably to figure out how to extract the download agent firmware from its binary file, and optionally to extract the index mapping chip indices to their download agent firmwares from the vendor flash tool.