Has there been any experimenting done with the IR port and a game that uses the circle pad pro? That's one input that I rarely see discussed.
edit: also, since the 3DS can read the DS framebuffer and apply scaling, maybe there are some vulnerabilities (overflow?) to crack through the hypervisor