I found the easiest way to get into NFVIS was to use the CIMC to mount a Linux Live ISO, boot from that, mount the internal SSD and remove the user.cfg as
devz3ro pointed out.
After that I booted with rd.break to change the root password and the admin user password. The process that responds on port 22 is some sort of cisco proprietary SSHD but the real SSHD is listening on port 22222 at least in my ancient version of NFVIS. Need to disable the firewall to get to it though.
Maybe they made it better in the later versions, but mine was just a lousy wrapper for qemu that wouldn't even let you power off a VM if it was in the "wrong" state, like "starting up"
I added 1x
MTA36ASF4G72PZ-2G3B1 to expand to 64GB, and these
UCS-SD120GBKS4-EV work for the drive carriers. I'm not using the S3510s in the ENCS, I swapped with some drives I had laying around (3.8TB PM863, 1.9TB HK4R) and they work fine.
The Python code for configuring the switch is all in /opt/switch-confd
Fans are controlled by the CIMC CPU I believe, and they are the same volume with ESXi as they are with NFVIS, very reasonable for a 1U but I'm not sure I'd want it in the same room with me. If you disconnect 1 fan though the thing goes full blast and that's extremely loud. In normal operation it's about the same level as my 1U 48P gig switch.