Yeah, I pulled the firmware. There’s a hidden flag that flips a privileged mode when a specific byte sequence hits the UART buffer. It’s not a classic backdoor, more a debug shortcut. If you send me the packet dumps, I can point out the exact bytes and the checksum routine that checks for it. Just be prepared to watch the log explode.