Possible exploitable 3DS errors and backdoors

Current version: 1.0.0-1

Template:P/3DS Homebrew

Game/App	Exploitable error or backdoor	Demonstration
Download Play	I had an idea: If someone develops a DS homebrew which can connect with 3DS via Download Play, we can run another exploit (And who knows if that is able to touch the ARM9Loader?)
Kid Icarus Uprising	Like smashbroshax, in this game we can recieve hax code via Wi-Fi to use homebrew. We'd use a PC tool (Or even another console via homebrew or already holding with the gem installed) to send a hax gem. When the 3DS detects the gem, it'll take it. touch that gem and...Welcome to HBL!
Metroid (NES VC)	There's some passwords on this game which access to broken levels (Mostly the starting zone of Brinstar). Nintendo had "the most intelligent idea" patching these passwords. How? Well, If you put these passwords(For example: The Tails Code or the famous ENGAGE RIDLEY MOTHER FUCKER)on the password menu you'll be kicked by a console freezing (You've to force the turning off if you want to exit from that error).	Video
Netflix	Why not if tubehax were a succesful project? It would work like that (Or probably Nintendo already learnt completely that intention)
Nintendo Anime Channel	The same cause of Netflix.
Pokémon (All main games)	If we modify a Pokémon holding an exploit code itself, we'd be able to get into HBL (I already know about basehaxx). When does the exploit run? When that Pokémon is going to battle or if we see the summary. I see this possible, but hard to do. It'd be easier on VC versions because of their poor bug corrections (But there isn't an editor yet. Only for XY/ORAS or a savegamehax like ironhax intsead).
Pokémon Shuffle	I'd like to know why my 3DS freezes on Streetpass menu of the game when I connected on the Internet for the first time. Is another stinky bug which can be exploitable?
Super Smash Bros. for 3DS	smashbroshax wasn't so bad at all. There are a lot of bugs on this game and at least ONE of them is exploitable and we don't know. Normally these bugs come from buffer overflow or full RAM (Mostly of them are because of the reflectors of many characters that make returned attacks bigger than normal).
System Settings	I have a lot of imagination, and this is only a theory, but this might be possible (And very dangerous). When we update our NAND via "System Settings" our 3DS is connecting to the Internet requesting the secret URL to download the hosted updates there. So (If I'm not getting wrong) we can change that default URL direction via modding (Homebrew) or even DNS (Like tubehax usage) to install modified updates hosted in another server and...get CFW fastly (OR EVEN ARM9LOADERHAX)!!