I was thinking that Grezzo handled MM3D development like OoT3D, they probably reused a lot of code, so even though I can't go and RE the code myself, I think it's *likely* that they didn't add sanity checks. If ROP can be achieved in MM3D, the game is bundled so a properly signed .CIA for all regions could eventually be dumped (that would work on sysNAND), and you could use GW OoT exploit to install it and use savedatafiler to inject the save. Just a wild guess.