tl;dr: Author salvaged a deactivated Cricut Maker from e-waste and bypassed its lockout by using an RP2040 as a USB proxy between the cutter and computer, rewriting the serial number in transit (USB CDC packets had no checksums or crypto). After replacing perished rollers and installing the RP2040 interceptor, the machine registered fine in a Cricut account — even with fabricated serials — highlighting a potential attack vector where strangers could hijack or deactivate others' serial numbers.