I learned at least four neat things in this post on "Looking into the Nintendo Alarmo": https://garyodernichts.blogspot.com/2024/10/looking-into-nintendo-alarmo.html
1. mmWave sensors are actually shipping in consumer products (not just nerdy things*)
2. "OCTOSPI" region maps to external RAM and includes most of the firmware
3. You can hijack the CRYP interface with enough keystream to decrypt more stuff
4. The CRYP interface places partial keys in 4 x registers and you can brute force the 4×2^32 to recover the original key
* I spent far too long on a Go serial library for Seeed Studio mmWave sensors but gave up after the cross-room heartbeat/respiration detection required too long to lock the signal (and the logic is in the fw, so no raw data to work with to improve it)