I installed a9l on my o3DS XL without a functional nand mod.
Because I decided it was worth the risk. You need to downgrade to 2.1 or below to dump OTP. (2.x recommended since you can use brower hax to get OTP without needing Cubic Ninja). I downgraded emunand first (so that if it crashes/errors out, I don't end up with a frankenfirm/brick) and after seeing that it downgraded without error, I flashed that to sysnand and it booted up just fine. (just delete home menu extdata from SD card or boot without SD Card inserted afterwords. Otherwise it will look like it bricked and give you a scare.
)
Once I had OTP I used a special version of Decrypt9 that works from 2.x browserhax to restore 9.2 sysnand. I compiled arm9loaderhax with the resulting OTP and installed it.
All that without a nand mod. It's a little more risky but the downgrading emunand then transfer to sysnand method would work for n3DS too. Only you swap encryption type on ctr nand partition of emunand before flashing emunand to sysnand. I imagine derypt9 nand restore of sysnand would work the same way on n3DS.