On an iOS device without bootloader exploit - any reason we can't do somthing similar to a kexec()? That is, replace a running kernel with a new one.