Maybe the combo to launch the diagnostic software, which is not included in the CAS+?

The RS232 log should tell if that's what it is.

Here you go

Did you remember the 32-byte header?

You could also try sending it as a temp image (headerless)...

I don't know. I haven't yet tested exploiting the bug over rs232 in nspire_emu.

It allways stops at 21%...

Strangely, I've tried my modified 1.1.9227 OS (with the added header), and I got the same error, but at 97%...

You can prepend almost whatever you want at the beginning of the file - boot2 searches for the first 0x1A byte and starts working from there, so as long as you don't add a 0x1A byte, it shouldn't affect things. Maybe there's an xmodem issue that's truncating the file? Try some different amounts of padding, like try to make the file a multiple of 0x400 bytes (the maximum xmodem packet size) or something.

Edit: it also tolerates padding at the end; 0x400 extra null bytes at the end should fix any xmodem truncation issues.

Heisenberg uncertainty principle: Δx Δp = h/4π

I think most physicists would agree that the more natural constant is ħ = h/2π. (There's that 2π again.)

Although boot2.img is sent on RS232 as-is, OSes must be sent with a 32-byte header. The first 24 bytes, as far as I know, are unused. Bytes 24-27 are the size of the data to write to /tmp/manifest_img (nspire_emu always just set this to 0, and it worked, so I guess it's not important. Probably something left over from the CAS+.), and bytes 28-31 are the size of the data to write to /tmp/TI-Nspire.tnc. (Note: these sizes are big-endian)

printf("Loading OS from %s\n", os_filename);
FILE *f = fopen(os_filename, "rb");
if (f) {
        u8 *mem = ram_ptr(arm.reg[0]);
        u32 size = fread(mem + 32, 1, arm.reg[1], f);
        memset(mem, 0, 28);
        mem[28] = size >> 24;
        mem[29] = size >> 16;
        mem[30] = size >> 8;
        mem[31] = size;
        fclose(f);
        arm.reg[0] = 0;
} else {
        perror(os_filename);
        arm.reg[0] = 1;
}
arm.reg[15] = arm.reg[14];

Edit: Here's a possibility to recover the OS. Use Home-Enter-X to send a "temp image" (a .tno/.tnc file, without the 32 byte header) - it will run the sent OS without installing it. It will have to be compatible with the installed OS, though, in terms of filesystem contents. I tried using a modified nspire_emu to run 1.1.9227 on top of a 1.1.8008 installation; there were some messed-up text messages but other than that it seemed to work fine. If you could run a USB-capable OS on top of a 1.1.7320 installation, then you could probably just dump the old OS with TiLP.

Goplat, if it's parsing "70" to the ASCII codes 0x37 and 0x30, then "01" would read 0x3031, not 0x3001. 0x01 is a non-printable ASCII control character.

Right, that was a typo, sorry