That's where I am.
TegraRcmGUI (2.5) says:
"Uploading payload (mezzo size: 92, user size: 77762, total size: 143978, total padded size: 147456)...
Switched to high buffer
Smashing the stack!
Smashed the stack with a 0x7000 byte SETUP request!
Payload successfully injected
RCM device...