For anyone on latest firmware and running it through the latest loadiine GX2 with the app-based tcpgecko exploit (since browser doesn't exist), the offset I found to work was 126976 (+0x1F000).
auto
On the latest US system version, and latest loadiine gx version, my offset was 126976...