I had the exact same problem you encountered. But on my frankenfirmwared n3ds from 9.9 to 9.2 could enter mset.
What I did: used smashhax (you can use ninjhax or oothax too) but you need to use 9.2.0-26(region) payload not 9.2.0-20(region). i don't know why but only this payload boots hbl succesfull. you can download it on smealum.github.io
Use sysupdater to finish downgrade