XAJ9 definitely exists, recently had my vulnerable XAJ40002 switch refurbished and it returned as a XAJ95000 console, tried to enter RCM but it fails with a black screen on the switch, TegraRcmGUI claims to have successfully injected the payload but it smashed the stack with a 0x0000 byte SETUP...