[CA Conservative]

The retry counter could be incremented by 0 instead of by 1.

The retry delay code could be removed or branched around.

And you are so intimately familiar with the base code of the iOS and the firmware that you know for a fact that none of what you are suggesting relies on any code or commands already burned into the ROM, making it difficult to devise a software-only workaround?

[DiogenesLamp]

And you are so intimately familiar with the base code of the iOS and the firmware that you know for a fact that none of what you are suggesting relies on any code or commands already burned into the ROM, making it difficult to devise a software-only workaround?

So you think perhaps they are keeping the value of the count in ROM somewhere? :)