Isn't this kind of silly? My implementation relies on exactly one instruction still being in memory post-reboot -- that's really very safe, considering the RAM uncleared on reboots flaw is well-tested. Everything else is loaded from NAND per normal A9LH (in fact, the single instruction I rely on being in RAM is just a branch to normal A9LH payload).
I do agree bruteforce free hardmod a9lh would have been nice, but I also don't see how you could get NAND payload loading out of a single branch? You'd know better than I would, I'm sure, but I don't actually understand the principle there. Unless, of course, you mean you were hoping for a branch to the normal A9LH payload location.