Finally rooted. What a ride!
User was torturous and fun at the same time. Learned a lot on the way. Baby steps with a lot of enumeration and constantly combining information that you found previously. Every step felt like a victory.
That one exploit was some black magic indeed! Unfortunately I had some trouble reading the credits I found, and stupidly overlooked a simple fix. Thanks to @clubby789 for giving me a nudge!
Root was really easy once I got on the right path, but very fun and satisfying. Unfortunately somebody had rewritten an important file, so it took me some extra time to get on the right track.
Great box @MrR3boot - thank you for the adventure!