I thought of another workaround based on the download play method but it would require to buy an old second hand 3DS compatible with the gateway (4.x one). As you can install .cia to sysnand (if you don't setup any emunand), the trick would be to install an eshop game with 9.0 firmware (Sugar.Rush.3D.JPN.eShop.3DS-BigBlueBox is said to have 9.0.0J firmware) on the old 3DS sysnand.
The game might not require 9.0 to run but would probably not run on 4.x sysnand so I bet the game would ask for an update, which would update the old 3DS to 9.0J. Then, the trick of the download play with a compatible game should ask the N3DS (client) to accept the 9.0J update to play the game.
Note that I never tried this method, but I suppose it would work. It would require a hardmod to check if a 4.x sysnand could be updated with a eshop game (eshop games mean you should always have the last firmware if you can access eshop to download them, but as http://3ds.essh.co/
also list the firmware of eshop games, I suppose they also have a firmware update in them, for any reason.