You don't need to buy a game. Just have a friend lend you a single player game to get its private header. It's not a problem when you have to make a DSi transfer with another 3DS so why would it be hold against the SKY3DS+? It's easier to find someone with a game than someone with a CFW and the proper DSi game.
Since firmware 112 or 113, the editing cfg is not necessary anymore (unless I was very lucky and tried only game with that matched my private header).
I have no idea what you refer to with wrong header size. All header have the same size.
If you go online without a private header you *might* get a temporary ban. It's very likely though.
Disabling spotpass only prevent sharing of some data not everything and most likely not the info collected for the ban. It might help staying under the radar, the thing is we don't know.
Like I said before, wrong header size is what I found when I was searching about Sky3DS here long ago, so yeah, it's outdated.
I admited it and fixed my post earlier. So how's that "hold against the SKY3DS+"?
And about lend you a single player game, I think I remember I found info (yeah, from this site forum) about someone getting ban by using single player game header.
If this also wrong, am sorry then. But, well, I still recommend to buy your own game for the header to make sure it will be "private".
About baning, I just search the info on the internet, the purchase data still tied to NNID which tied to physical system.
Unless you do system transfer or calling them. Mean that purchase data can't be access except with those 2 options.
That's why I think disable spotpass & share data is enough. Well, that's just my opinion though.
If that data can be check easily, all people with CFW should already go boom, not some of them.