diff --git a/exosphere/src/coldboot_init.c b/exosphere/src/coldboot_init.c
index f4496867d..2a3da097e 100644
--- a/exosphere/src/coldboot_init.c
+++ b/exosphere/src/coldboot_init.c
@@ -122,6 +122,7 @@ uintptr_t get_coldboot_crt0_stack_address(void) {
 
 void coldboot_init(coldboot_crt0_reloc_list_t *reloc_list, uintptr_t start_cold) {
     //MAILBOX_NX_SECMON_BOOT_TIME = TIMERUS_CNTR_1US_0;
+    //MAKE_REG32(0x7000E400ULL) = 0x10;
 
     /* Custom approach */
     reloc_list->reloc_base = start_cold;
diff --git a/exosphere/src/exocfg.h b/exosphere/src/exocfg.h
index 03296c433..c3af903d4 100644
--- a/exosphere/src/exocfg.h
+++ b/exosphere/src/exocfg.h
@@ -18,7 +18,7 @@
 #define EXOSPHERE_TARGET_FIRMWARE_500 5
 
 /* TODO: What should this be, for release? */
-#define EXOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG EXOSPHERE_TARGET_FIRMWARE_200
+#define EXOSPHERE_TARGET_FIRMWARE_DEFAULT_FOR_DEBUG EXOSPHERE_TARGET_FIRMWARE_100
 
 #define MAILBOX_BASE_PHYS  (MMIO_GET_DEVICE_PA(MMIO_DEVID_NXBOOTLOADER_MAILBOX))
 
diff --git a/exosphere/src/start.s b/exosphere/src/start.s
index a08b177fd..2b4bebeb3 100644
--- a/exosphere/src/start.s
+++ b/exosphere/src/start.s
@@ -89,11 +89,13 @@ __start_cold:
     cmp  x0, x1
     beq  _post_cold_crt0_reloc
     1:
-        ldp  x3, x4, [x0], #0x10
-        stp  x3, x4, [x1], #0x10
+        ldp  x3, x4, [x1], #0x10
+        stp  x3, x4, [x0], #0x10
         cmp  x0, x2
         blo  1b
 
+    adr  x20, __start_cold
+    adr  x19, g_coldboot_crt0_relocation_list
     ldr  x16, =_post_cold_crt0_reloc
     br   x16
 
@@ -104,9 +106,9 @@ _post_cold_crt0_reloc:
     mov  sp, x0
     mov  fp, #0
 
-    adr  x0, g_coldboot_crt0_relocation_list
-    mov  x19, x0
-    adr  x1, __start_cold
+    /* X1 is already set to __start_cold (original load location) from above. */
+    mov  x0, x19
+    mov  x1, x20
     bl   coldboot_init
 
     ldr  x16, =__jump_to_main_cold