I have been looking at the irom code. With om = 9 it tries to load bootloader from onenand, then sd card, then download over usb / uart . The onenand has a power control registers, so we might be able to power down the onenand, forcing it to boot from sd card.
I also looked at the IBL , but it does not seem to do much more than boot the PBL .
I have not seen the irom talk to the sim card yet. It would be easier if i knew which uart was connected to it. Does anybody know?
The interesting bit of the irom is what it does if the boot is not a cold boot. It needs further investigation.
Finding a way to disrupt the onenand during boot still seems to be the best option.