You're not answering any of my questions!
I can't help unless you said what you did. Did you force-loaded the 1253A/B firmware into the 1273AX?
Must be 78K0, AFAIK 78K0S is completely different.
I was checking the bootloader to see if there was any failsafe mode.
This is what it does:
sub_060e: ; From reset vector and basic init
di ;060e 7b 1e
push hl ;0610 b7
mov a,#0x00 ;0611 a1 00
mov !mem_e2a7,a ;0613 9e a7 e2
mov BANK,#0x05 ;0616 13 f3 05 ; Set flash bank 5
movw ax,!0xbffc ;0619 02 fc bf ; Get data at flash address 0x1FFFC
cmpw ax,#0xfafa ;061c ea fa fa ; If not 0xFAFA
bnz lab_062c ;061f bd 0b ; Enter updade mode
mov BANK,#0x00 ;0621 13 f3 00
call !sub_040c ;0624 9a 0c 04
call !sub_7f00 ;0627 9a 00 7f ; Otherwise continue booting (Call app)
br lab_063d ;062a fa 11 ; Return from app, enter updade mode
So there isn't any failsafe procedure in the bootloader itself!
Agilent wasn't very nice here, all the firmwares have 0xFAFA there, should have used different values/addresses or additional checks to prevent such stupid bricking.
Their thinking probably was "As the entire flash is erased before updating, if the last bytes are ok, the rest will be too".