10.0.0-27
The Old3DS+New3DS 10.0.0-27 system update was released on September 8, 2015. This Old3DS update was released for the following regions: USA, EUR, JPN, CHN, KOR, and TWN. This New3DS update was released for the following regions: USA, EUR, JPN, CHN, and KOR.
Security flaws fixed: yes, see the ARM11-kernel section here.
Change-log
Official USA change-log:
- Further improvements to overall system stability and other minor adjustments have been made to enhance the user experience
System Titles
<fill this in (manually) later>
NATIVE_FIRM
Minus configmem init, exactly 4 functions were updated in the ARM11-kernel(at least one was for fixing a security issue). See here for details on that.
Process9
One of the changes was that main() was updated. Three functions(two initialization functions + launch_firm()) which were previously called directly are now called via a wrapper function with a funcptr parameter. As a result, the main() prologue/epilog changed. This is for temporarily relocating the stack elsewhere(same relocated-stack-addr for all func-calls), just for calling the funcptr(all registers except for r0..r3 are saved/restored before/after calling the funcptr).
Some FS-related code seems to have been changed.
There's also some new UTF-16 strings in the .(ro)data, but there's no(?) known code which actually uses these.
New3DS-only
No actual code/data was changed in the arm9loader.
During loading, kernel9 copies the entire Process9 NCCH to a relocated base-addr, which is: endaddr - ncchsize. On Old3DS, endaddr is 0x080fffe0. On New3DS, endaddr was 0x080fffe0 prior to v10.0-FIRM, now it's 0x0817ffe0.
The Process9 .bss(which contains the proc9 heaps too) is larger now: previously the .bss ended at address 0x080ff080, now it ends at 0x08117040.
Therefore, *all* of the extended New3DS-only arm9mem gets overwritten during FIRM boot with v10.0.
See Also
System update report(s):