From
https://www.3dbrew.org/wiki/3DS_System_Flaws
GSP module does not validate addresses given to the GPU. This allows a user-mode application/applet to read/write to a large part of physical FCRAM using GPU DMA. From this, you can overwrite the .text segment of the application you're running under, and gain real code-execution from a ROP-chain. Normally applets' .text(
Home Menu,
Internet Browser, etc) is located beyond the area accessible by the GPU, except for
CROs used by applets(
Internet Browser for example).
FCRAM is gpu-accessible up to physaddr 0x26800000 on Old3DS, and 0x2D800000 on New3DS. This is BASE_memregion_start(aka SYSTEM_memregion_end)-0x400000 (0x800000 with New3DS) with the default memory-layout on Old3DS/New3DS. With
11.3.0-X the cutoff now varies due to the new
SVC 0x59. The New3DS "normal"(non-APPLICATION) cutoff was changed to 0x2D000000 due to the new
SVC 0x59.