Also I binwalk'ed the firmware, extracted a linux kernel and ramdisk (where is the source code for all of this, señor IBM?), and there are hints in /drv/dcode.exe that there are some licensing options available. Like SME (system managed encryption). Is any of that stuff useful? There is also a string: **lib license enabled** , license %x, enabled %x
Also I think there is a remote code execution possibility (remote root shell), if only I could turn on DHCP on the ethernet port. Sadly it is stuck at static 192.254.0.3. Image references dropbear, but binary was left out.
Found a MAX3232 on the PCB of a dead LTO 5 going to an unpopulated 3-pin SMD location. Smells like GND RX TX for a serial console to the processor.