Post

Sonix, WTF are you doing? Found in SNC7320 bootrom (used in a couple of Precure toys and later wave Tamagotchi Pix)

Thankfully this isn't on the main boot path, but it is if you try to use deep power down.

Probably should explain since it might not be obvious, load_str is a 32-bit integer marker (not intended to be pointer), and the second number is what that marker should contain, but as-written it's some random location in SPI flash.

FWIW, this probably does work if you set everything up as expected, i.e. make sure load_str is 0x64616F6C and call the setup function to enable the feature, however this also would pass if you give garbage that happens to line up with what it checks for,

i.e. if the flash isn't filled and at 0x64616F6C it reads with 0xff bytes, and you submit some memory where the first word also points to a random place in flash that reads 0xff, and the addresses in the rest of that table happen to fall in valid memory regions.