[Recovery – NOT an unlock request] HP Envy 17-cg1001na, corrupted Insyde

[heather1202]

corrupted Insyde BIOS after interrupted flash, need help identifying correct offset

Hi all, I know this board is mainly for unlock requests, but I couldn't find as active an Insyde-specific board elsewhere, and I'm hoping someone here might recognise this. Apologies if it's not the right fit.
Background: Battery was accidentally disconnected during a BIOS update via HP Support Assistant, mid-flash from F.40 → F.42. Laptop now fails with "System BIOS recovery failed / Unable to open BIOS image file," and standard USB crisis recovery (Win+B) with a fresh F.40 SoftPaq from HP fails the same way.

Specs:

• HP Envy 17-cg1001na (30A27EA#ABU)
  
• Chip: 16MB
  
• Board ID: 8823
  
• BIOS: InsydeH2O
  

What I've got:

• A dump of the corrupted chip contents, which still contains F.42 data
  
• The clean F.40 SoftPaq downloaded from HP
  

What I've tried: A few manually-patched combinations of the corrupted dump and clean F.40 file. Results have been inconsistent — some versions give no power at all, others power on and blink the caps lock LED (haven't decoded the pattern yet), none have booted to Windows.
Most recent attempt: Using HxD, found a $Bin08822 marker in the corrupted dump, located the matching point in the clean HP file, and manually spliced that section across. Also opened both files in UEFITool 0.28.0 — found several "08822" text matches, one inside what looks like a driver/PE32 module, and one inside the ME region (which I'm avoiding). Not confident I've found the right target.

I'm working via desoldering/resoldering the chip rather than a clip, so each attempt has real cost — would really appreciate anyone with Insyde/HP experience taking a look before I commit to another write. Happy to share both files.