Hardware: Switch V2, model HAC-001(-01). S/N 49E7FEB2. Modchip installed (RCM accessible), Hekate v6.5.2 boots fine. SD card previously ran a pre-made "CNX" CFW pack; I wiped that and installed clean official Atmosphere 1.11.2 + Hekate configs myself.
Symptom: SysNAND boot (emummc_force_disable=1) gets past pkg1/pkg2/package3 loading, mounts the SD card (creates /Nintendo/Contents, /Nintendo/save, /Nintendo/Album as expected), but then hangs on a black screen and never reaches qlaunch or hbmenu (tried holding R for hbmenu override, no difference).
Atmosphere fatal_errors reports (AFE2 format, decoded with the official struct from panic.h) show the exact same crash every single boot attempt, regardless of cal0blank=0 or cal0blank=1:
- Title ID: 010000000000002B (erpt)
- far: 0x0000000000000008 (null pointer + small offset)
- esr: 0x00000000
- pstate: 0x20000000
- Same offset from module_base to PC every time (0x37FB8)
- stack_trace_size: 3, stack_dump_size: 256
Ruled out so far:
- eMMC hardware: 100% healthy (Hekate reports Estimated Life A:100%, B:100%, Reserved Used Normal <80%)
- Partition table: looks completely standard (PRODINFO, PRODINFOF, BCPKG2 x6, SAFE, SYSTEM 2560MiB, USER 26624MiB, all present)
- Not an EmuMMC issue (EmuMMC is separately broken/incomplete, but this crash happens with emummc_force_disable=1 using real SysNAND)
- Not cal0/PRODINFO related (same crash with cal0blank=1, which blanks calibration data)
- Not the SD card (reformatted/chkdsk'd a corrupted FAT32 on it, files verified intact, crash persists)
No complete NAND backup exists (only BOOT0/BOOT1 and a partial/interrupted rawnand.bin fragment from a previous incomplete backup attempt).
My read: something in erpt's own code/data on the real SYSTEM partition is corrupted (not PRODINFO-related), and it's crashing during boot2 before loader ever gets to the qlaunch/hbmenu override point, so I can't reach hbmenu to run Daybreak and reinstall stock firmware normally.
Questions:
1. Anyone recognize this exact erpt null-deref-at-0x8 signature?
2. Is there a supported way to have boot2 skip launching a specific stock NAND sysmodule (not an SD-added one) so I can get far enough to reach hbmenu and run Daybreak?
3. Alternative: has anyone done an SD content-override (/atmosphere/contents/010000000000002B/exefs) with a clean erpt extracted from an official firmware package to patch around a corrupted NAND copy of a sysmodule? Any gotchas with keys/versions I should know about before trying that myself?
Happy to provide more Hekate dumps/screenshots if useful. Thanks in advance.
Symptom: SysNAND boot (emummc_force_disable=1) gets past pkg1/pkg2/package3 loading, mounts the SD card (creates /Nintendo/Contents, /Nintendo/save, /Nintendo/Album as expected), but then hangs on a black screen and never reaches qlaunch or hbmenu (tried holding R for hbmenu override, no difference).
Atmosphere fatal_errors reports (AFE2 format, decoded with the official struct from panic.h) show the exact same crash every single boot attempt, regardless of cal0blank=0 or cal0blank=1:
- Title ID: 010000000000002B (erpt)
- far: 0x0000000000000008 (null pointer + small offset)
- esr: 0x00000000
- pstate: 0x20000000
- Same offset from module_base to PC every time (0x37FB8)
- stack_trace_size: 3, stack_dump_size: 256
Ruled out so far:
- eMMC hardware: 100% healthy (Hekate reports Estimated Life A:100%, B:100%, Reserved Used Normal <80%)
- Partition table: looks completely standard (PRODINFO, PRODINFOF, BCPKG2 x6, SAFE, SYSTEM 2560MiB, USER 26624MiB, all present)
- Not an EmuMMC issue (EmuMMC is separately broken/incomplete, but this crash happens with emummc_force_disable=1 using real SysNAND)
- Not cal0/PRODINFO related (same crash with cal0blank=1, which blanks calibration data)
- Not the SD card (reformatted/chkdsk'd a corrupted FAT32 on it, files verified intact, crash persists)
No complete NAND backup exists (only BOOT0/BOOT1 and a partial/interrupted rawnand.bin fragment from a previous incomplete backup attempt).
My read: something in erpt's own code/data on the real SYSTEM partition is corrupted (not PRODINFO-related), and it's crashing during boot2 before loader ever gets to the qlaunch/hbmenu override point, so I can't reach hbmenu to run Daybreak and reinstall stock firmware normally.
Questions:
1. Anyone recognize this exact erpt null-deref-at-0x8 signature?
2. Is there a supported way to have boot2 skip launching a specific stock NAND sysmodule (not an SD-added one) so I can get far enough to reach hbmenu and run Daybreak?
3. Alternative: has anyone done an SD content-override (/atmosphere/contents/010000000000002B/exefs) with a clean erpt extracted from an official firmware package to patch around a corrupted NAND copy of a sysmodule? Any gotchas with keys/versions I should know about before trying that myself?
Happy to provide more Hekate dumps/screenshots if useful. Thanks in advance.
