I hate to bump this old thread but a friend is fighting one of these and so far flashing hasn't worked (one time it "bricked," another attempt with a different file brought it back but with password still intact). I've been trying to figure out how to determine what those missing four digits from the service tag should be to no luck... I guess next stop is try a whole bunch of possible suffixes and see if any work, but before that I thought it might be worth asking here.

The service tag is 4N96SZ1
The system disable hex is 7227 F5BA 996B 2BB9

Thanks a...