I've also done some voltage modification and identified three unique startup power states.

A 0.038a held state
A 0.124a latched state
and a normal 0.219a boot-idle state without SATA


At 0.038a the JTAG transport and debug port come alive very early, before the downstream AP/debug fabric is fully available or powered. This is found by bridging a few points through a 1kOhm resistor. Removing the bridge sends the drive to a full boot.

Under-volting the 1.8v VTref can get you into a latched 0.124a startup state where you get unstable / corrupted JTAG read behavior. The problem is that state isn't recoverable. Restoring the VTref voltage doesn't push it along to a full startup, so no way to
use the misbehaving JTAG to, say, modify some bytes with a malformed write and release the drive to finish booting.

I haven't seen that in ISO images. That is the format in which the firmware is stored on the SSD.

It spills out once you remove the encryption and archive layers. Here's the full file, yours is missing like ~7500 bytes from the end.



The updater (fumagician) in the bootable ISO is basically: IDENTIFY DEVICE, READ BUFFER (E4h) to select the matching component, then it decrypts and removes the package wrappers, and sends that .bin component via DOWNLOAD MICROCODE (92h) to the drive.

The attached .bin is the 01 component, specifically.