So, I messed up downgrading a friends 3DS to 2.1.0 and now it's stuck at 11.0. I can get into HBL through oothax if I try a bunch. I've been told already that the NAND can't be written to without escalated permissions but I have evidence to counter this thought. I was able to dump and flash my NAND on 9.2 without any kernel access back in 2015 using Gateway's launcher tool. I'm not trying to downgrade the system by reinstalling titles, but trying to straight restore a NAND dump - which I've read can be done in DSi mode under the right circumstances. I suppose I'm asking, is it possible to restore it in userland or is the TWL mode for standard DS have access to NAND writing and would that work with a flashcart? I don't want to hardmod the system (or pay for it) and neither does he. I'm just trying to get a solid answer on whether or not this is feasible at all right now in some way now.