[lolita]

The BREC code in the working firmware you provided selects CE5 by the usual means. However, your mention of CE1 fluctuating when accessing the flash suggests that the appropriate CE is enabled *only* during read/write operation.

Select CE5 ("o 2 28" in s1giveio), then try reading anything from memory address 8000 or above (e.g. "r 8000") while monitoring CE5. It should pulse low and then go high very very quickly, once the read is complete.

However, getting an hourglass means the controller code in the BREC is compatible with your player, but the one in the firmware you provided is for a "big PCF8833-compatible" type LCM controller; as you may remember, the original GXBL177-xxxx firmware you found is for a different controller, the rarer HD66xxx. Maybe that one was mislabeled or GXBL177 is actually the backlight's part number, and GA177 is the actual display's part#. This confirms that your player has the "big PCF8833-compatible" type controller, probably LDS285,ST7669, or ST7732/35/73. Firmware for those are much easier to find.

Is the only issue with that firmware the incorrect screen size? I.e. controls, playing music, etc. works?

s1fwx cannot work with v9 devices. Use s1res v4.0 instead.