Okay, after reading an installation tutorial, it seems that it touches the security sectors on the HDD and it also reflashes the SMC, so something wonky is going on.

The SMC has been used in the JTAG exploit to set up DMA transfers from NAND to RAM in the past. Just triggering the final read wasn't possible from the 8051 core, so that's why this trigger happened by writing the right registers over the GPU's JTAG port.

Maybe it's something similar, just that the trigger or destination address for a DMA READ comes from the race?