One question that has yet to be answered. While flash carts are confirmed not working, Still to be tested, are the 2 cheat carts, Action replay, and Code Breaker. Action replay is a remove and insert game card type, and the code breaker is a pass through type. (also could act as remove and insert game card with firmware updates.)
Finally, we might just have to look at one attack vector that hasn't been looked at yet. Save game vulnerabilities, and Wireless communication vulnerabilities.
Wireless communication vulnerabilities would be the DS/DSL sending the signed loader to the DSi, (extracted from a game), then sending malformed data packets to that loader, causing the DSi to execute unintended code.
Then there are save game vulnerabilites that could be utilized as well. Mario Kart DS has a 256KiB save file, which IIRC, is copied in full over to main ram, and only copied back to the save when changes are made. If a stack smash is found somewhere, that smash could jump into that ram location. The game does encrypt its save, but that isn't a problem.
One more idea. Remember the Passme, and Passme2? What we have to try, is seeing if the DSi is using white listing or black listing. If it is using Whitelisting, then modifying something simple in the header won't work at all, as this would break the white list. If it is using black listing, which would be every flash cart / cheat cart that nintendo knows about, then a simple header modification should work.
The other thing, is that there is a 16KiB Secure area that can not be read out once the game card is in its final read mode. Only the first 2 KiB IIRC, was blowfish encrypted. At this point, there is some code stored there. They might have also stored other important info there, that up until now, Nintendo has never bothered to verify, like RSA signatures. If that is the case, then no unlicensed cards will ever work on the DSi, without nintendo's private key.
