*disclaimer, it's 2 AM on a tuesday.*
Basically, the nleash exploit for 2.x was a zip that extracted beyond the size of the calcs available ram, causing corruption that slid into some code that did stuff(What it did, I don't know.)
The .tno/.tnc's are zips(along with a large portion of the nspire.img inside.)
Would it be possible to basically make a custom OS upgrade and put ndless inside, or does the zip routine in the new boot2 actually check for an overflow?
Edit: changed all instances of 'ndless' in this post to 'nleash'