In the recent talk by Smea, Derrek and Plutoo we learned about a new hack called SNShax
Tl;Dr
SNS means Safe Nintendo Shell, and the hax possible with it can be used to downgrade from 9.3-10.1 down to 9.2, and it is currently only possible on a new3ds, though Smea has said it may be possible on old3ds with a workaround. It was patched in system version 10.2
Vuln
SNShax is a small oversight by Nintendo, usually the NS service (possibly meaning Nintendo Shell, though that is speculation) is in an area inaccessible to the GPU, meaning gspwn isn't useful for using it. However the new3ds safemode version of NS can be launched and, since the original NS service is still in use, it has to be allocated in an area accessible by gspwn (provided the memory is set up properly) and access can be gained, with ROP, to the services it uses (am:u and others) which, in turn, can be used to downgrade. It is not possible on the o3ds (yet) as the Safe Nintendo Shell version the o3ds uses is prevented from launching while the standard version is still running. This wouldn't be a problem if NS wasn't required to start any version of itself up.
Uses
As stated above it is possible to use this to downgrade any system title, in turn allowing full system version downgrades. This makes it possible to downgrade to any system version which we have legit CIAs for.