It can flash in preboot, so i wonder is it possible to 'erase' rgn41 by flashing an RGN file made from an empty bin file. It would need to have the region set to 29 in hex i guess. 41 is encrypted so maybe need to decrypt an appropriate 41.bin of correct file size, preserve some header info and replace the rest, encrypt again blah blah - but i'm blathering, dunno really. Hopefully kunix or someone who knows will weigh in with an opinion. But if 41 can be erased somehow and it still won't boot then it would seem to be damaged flash chip for sure.