SOLVED!
Hey all! I found a software-only solution! No hardware chip flasher required.
I detailed it over here:
https://www.reddit.com/r/homelab/comments/175usvd
, but the interesting bits are:
1) Got signed BMC firmware 4.01 from SuperMicro tech support. It flashed perfectly over top of the signed 3.88. You can find it here:
https://file.io/kZqOqBlp5HEx (Why the signed versions aren't publicly available I can't understand.)
2) The Signed BIOS 3.4 I also got from them still wouldn't flash with any of the BMC web interface BIOS updater, running SUM under Linux, or the UEFI AFU.
3) Drawing upon some hints from others which still didn't work for me but led me in the right direction, I stumbled upon the combination of (some undocumented) extra flags to apply to the UEFI version of the AMI Flash Updater ("/X /GAN /CAPSULE") to get it to essentially override all the secure flash verification and let me flash the latest public/unsigned 3.5 BIOS. (This may have also worked to flash the signed 3.4, but I didn't bother trying that again since going straight to 3.5 with this process worked).
So, if you download X10DRU2.427.zip (X10DRU-i+ BIOS v3.5) from the Supermicro site, extract it, look in the UEFI folder for the flash.nsh file, and change the two instances of this line:
afuefix64.efi %1 /P /B /N /K /R /ME
to
afuefix64.efi %1 /P /B /N /K /R /ME /X /GAN /CAPSULE
then it will flash the latest available version successfully! Take special care to double check the BIOS file is the right one for this board, because these flags will override a number of safety check that could allow you to brick your board by flashing the wrong file.
Cheers!