I have decided to think outside the box and send some malformed packages to the WiFi stack, and lo and behold, I managed to crash the 3DS. What's better is that there is some uninitialized memory space which is preserved across reboots - as long as you don't power off the device - and from there...