If you'd have a FFFF0000 dump - it would be very easy to make a flag-changer (as I did in the rescue disk)
I'm leaving for couple of days - so I can't help you, but:
The FFFF0000 is structured like this:
First there are couple of IRQ's. The first is the main entry point.
In this procedure, system checks the bootflags and
a) run the loader program
b) run the specyfied place in memory (800000 or F8010000)
c) run the menu
a) means: there is a small function that takes one argument ("code"), copies the loader program to RAM (attached at the end of bootloader) and run the loader with the argument. It is copied so It can change ROM without problem.
loader takes the argument and do one of a switch like "load .fir file", "check and run AUTOEXEC.BIN" and so. One of the switch is a menu - and some of the options in the menu change the boot-flags.
If everything is like in 400D you can run the code in the rescue disk - and it will change the boot-flags as are in my camera (witch run AUTOEXEC.BIN
But I wouldn't experiment - I would dump the FFFF0000 on your place :-)