This was an exploit in pre 2.0 versions of iBoot
The diags function can be passed a parameter. It jumps to that parameter, but not before trashing the I/O table. You can run unsigned code using this, but there's no guarantee about the state of the that processor
In 2.0 iBoots, they check the permission register.