They shouldn't match. What the server is sending you is the sha256 of the arm9loaderhax.3dsx as well as the hash of otp.bin it used for the build. You see, they are 2 different files, their hashes shouldn't match in fact you should not run the .3dsx if they do. What you are supposed to do is...