This was an exploit in pre 2.0 versions of iBoot
The diags function can be passed a parameter. It jumps to that parameter, but not before trashing the I/O table. You can run unsigned code using this, but there's no guarantee about the state of the processor
In 2.0 iBoots, they check the permission register for this command, so the exploit doesn't work.