5268ac routers

[soxrok2212]

No XXD on the router, so copied the serialnumber file to a thumbdrive to look at it.
ls -l on the router itself gives a file size of 4096. Once copied it's only 13 bytes, with indeed a 0x0a after the serialnumber ASCII characters.
The code on the router that is using it goes out of it's way to remove the /n though....
        SERIAL=cat /sys/module/board/parameters/serialnumber
        PASS=echo -n ${SERIAL}STRNIGSTUFF | MD5SUM
So the string that is ported into the hasher does not contain any 0x0a.

Does anybody here know how to get the NVRAM commit to accept?
The access code is actually missing from the NVRAM (PSK, ESSID and MAC are already burnt in), so the algo to generate the access code might still be around somewhere on the router. I can change the SN (nvram set serialnumber XXXXXNXXXXXX and confirm with "nvram get serialnumber") but a reboot of the router resets that. nvram commit <enter> errors out with "could not initialize msg, ret=9002"
My thinking is that if I could change the NVRAM and do a factory reset, I could follow what is going on with the access code and get another clue for the encoding scheme.

There's 3 possibilities.
1: NVRAM is actually ROM (Read-Only Memory, aka you can't write to it, ever). Once it's burned in, that's it.
2: Its mounted read only. So you'll need to mount it read/write.
3: There's perhaps something like nvram save. Many router's have a CLI where you can commit a change, but not save it in case you screw up. It'll only set it for the running config so that if you screw up, reboot and it works again.

PS: hexdump probably exists on the router.