I Turned a $400 Enterprise AP Into a Fully Emulated Root Shell — Here's the Whole Story, Bugs and All