@codemonkeymike is there a way in your experience to extract the hash of the firmware password from the chip via SPI bus or similar ? Then run hashcat on it. It’s excessive for sure, but maybe a solution can be devised somehow. Extract some hash or firmware and find an exploit or something and find a working solution eventually. In the end the chip is an oracle and something is verifying the firmware password which has to be stored in memory.