If the sysNAND of a New 3DS console is below system version 9.6, it is not currently publicly possible to have NAND redirection work with a redirected NAND of any system version since 9.6. This is because the [[AES|AES engine keyslots]] introduced for NCCH decryption with 9.6 are initialized by arm9loader using data generated from [[OTP Registers|OTP data]] upon boot. Since OTP access is blocked via [[CONFIG_Registers#CFG_SYSPROT9|CFG_SYSPROT9]] shortly after that, it's impossible to perform this keyslot initialization at any later time.
+
If the sysNAND of a New 3DS console is below system version 9.6, it is not possible to have NAND redirection work with a redirected NAND of any system version since 9.6 without first [[3DS_System_Flaws#arm9loader|obtaining the relevant keys]]. This is because the [[AES|AES engine keyslots]] introduced for NCCH decryption with 9.6 are initialized by arm9loader using data generated from [[OTP Registers|OTP data]] upon boot. Since OTP access is blocked via [[CONFIG_Registers#CFG_SYSPROT9|CFG_SYSPROT9]] shortly after that, it's impossible to perform this keyslot initialization at any later time.