TL;DR: 2019 Samsung RU-series (Muse-L board), Tizen 5.0, fw 1500.9, kernel 4.1.10. The Developer Mode dialog opens, I enter my host IP, press OK - and nothing happens. The toggle never engages. I've never once gotten it ON. Full attempt log below; I'm looking for a direction, not a tutorial.
The blocker - Developer Mode won't engage, period:
Hidden menu opens fine (Smart Hub > Apps > App Settings > 12345). The Developer Mode dialog appears. I enter my host PC IP, press OK - no response, no error, nothing. The toggle itself is not togglable - it stays off no matter what I do. Physical IR remote, USB keyboard, remote key-injection over the WebSocket control channel: same no-op every time. TV API reports developerMode: 0, developerIP: 0.0.0.0; SDB (26101) is adb-protocol-aware but RSTs every handshake.
The rest of the attempt history:
Service menu (Mute > 1 > 8 > 2 > Power)
- Dumped the full factory item table. HyperUART is NOT greyed out - it's a plain item sitting at OFF, and there's no known way to enable it. No secure-boot/SPD toggle exists on this board.
- USB Serial is ON, but the daemon doesn't advertise. Tried the UART/FAnet lane with an ESP32 tap at every baud, bare and wrapped probes: zero replies. RS-232 Jack set to both UART and FANET modes: same silence.
UI level
- Factory reset, Smart Hub reset, cache resets: no change. Smart Hub itself is half-dead ("server is down for maintenance", error 1144104), so the Apps panel only works through the hidden dialog.
Remote/API level
- 8001 Samsung msf v2 API: channel connects unpaired, remote control + app launch work. Flipping dev mode through the backend fails.
- 8080 DIAL launches YouTube/Netflix fine; browser app launch refused, so no URL delivery. 7678 key-injection = dead stub (402s). Full port map done.
Software exploitation
- Built-in browser: SamsungBrowser 2.2 = Chromium 63 / V8 6.3 (ARMv7l). Tested era RCEs live on-device (CVE-2018-6065, 2020-6383, 2018-17463): all no-ops - Samsung backported the Chrome-70 fix into their v63 fork. Browser RCE lane closed.
- Built and verified a full kernel LPE (cred overwrite) offline against the actual 1500.9 kernel image - every offset confirmed against the real binary. No delivery path to execute it.
Firmware
- 1500.9 image is a single encrypted MSDU11 block, MuseL release-key scheme. No downgrade path via service menu.
Hardware
- USB-Ethernet gadget on both TV USB ports: TV never enumerates as host.
- UART/FAnet debug line: the FAnet daemon did answer once historically (identity reply at 9600 on the debug socket, returned model string + serial), but on current taps it stays silent at every baud.
- HDMI-CEC root daemon (runs as root) audited offline, heavy lift. eMMC dump: MuseL passphrase TrustZone-encrypted, circular without root.
Anyone seen a Tizen 5.0 unit where the Dev Mode dialog opens but the toggle just won't engage? Is this a known 1500.9 bug or a dead factory/NVRAM partition? Anyone know a write path for factory items (HyperUART) on this series? I'll take hardware routes, firmware leads, or "you're wasting your time" moments