Gateway loads firm in much the same way, only unlike CFWs, they pack the firm into their launcher. (it's obfuscated and encrypted of coarse). Hence why you can't link directly to Gateway's launcher on GBATemp due to the files containing Nintendo files.
So my suspicion about their firm being altered with a spoofed kernel version might be accurate then? I originally figured it was a patch being applied like removing the signature checks, but now I am wondering if it isnt the firmware binary itself that is being altered.
Also, uessing they pack both firms in since N3DS and O3DS use different ones.