Hmm, I know the factory firmware can be reliably crashed by sending malformed data over the network. I wonder if there's a RCE hidden somewhere in there which might allow bootstrapping to Linux over the network.