If anyone has any luck into converting the Default root of AP fix into a ARM9 addresses fix, then be my guess.
0x023FC400
00 00 9F E5 1E FF 2F E1 CF B3 00 00 00 00 9F E5
1E FF 2F E1 75 B9 00 00 00 00 9F E5 1E FF 2F E1
83 A8 00 00 00 00 9F E5 1E FF 2F E1 27 C1 00 00
1F 40 2D E9 24 00 8F E2 00 10 90 E5 01 00 51 E3
1F 80 BD 08 00 20 91 E5 04 30 90 E5 03 00 52 E1
08 40 90 05 00 40 81 05 0C 00 80 E2 F5 FF FF EA
30 6E 21 02 FC 64 21 6A 00 C4 3F 6A DC 6E 21 02
FC 64 21 6A 0C C4 3F 6A B4 6F 21 02 88 74 21 6A
18 C4 3F 6A 60 70 21 02 88 74 21 6A 00 C4 3F 6A
78 87 21 02 88 74 21 6A 24 C4 3F 6A 01 00 00 00
0x02004EBC
5B DD 0F EA
0x023FC400 = where to apply in a arm9 address est
Backup original ROM, to keep trying ^ with a new copy.