I'm kinda curious how the Race and DMA Attack in the Xbox 360 Peer Pressure exploit works. But there's neither a writeup, nor is it open source to read up on it. Sad.
I am too old to reverse engineer things from "the scene".
Okay, after reading an installation tutorial, it seems that it touches the security sectors on the HDD and it also reflashes the SMC, so something wonky is going on.
The SMC has been used in the JTAG exploit to set up DMA transfers from NAND to RAM in the past. Just triggering the final read wasn't possible from the 8051 core, so that's why this trigger happened by writing the right registers over the GPU's JTAG port.
Maybe it's something similar, just that the trigger or destination address for a DMA READ comes from the race?