Any easy way to unbrick RT3050F when bootloader has been overwritten in flash?

I have a D-Link DCS-930L revision A2 network camera. I believe I bricked it by trying to flash the factory.bin from the emergency web interface. Both the stock firmware and factory.bin are the same size, 4 MB, which is the size of the flash chip. However, the stock firmware starts with what seems to be vectors, code and strings corresponding to U-Boot. Those strings used to appear in serial output when starting up. The factory.bin is a U-Boot image, meant to be booted via U-Boot. In the stock firmware the U-Boot image starts at a higher address, after U-Boot itself. So I believe there's no more U-Boot on the device, and it starts up executing stuff which isn't meant to be executed like that, resulting in failure. Looking at serial output using an oscilloscope I see just the pins going high when power is applied, with no serial activity at all.

So, there's no way to unbrick via Ethernet or serial. I could apparently unbrick via JTAG, if there was a JTAG interface available. Unfortunately, I don't see a JTAG interface, and the RT3050F chip is a BGA, so I couldn't easily access pins which aren't connected. The only other thing I know of is that the chip has an iNIC mode, which uses internal ROM to boot in different ways, including via USB I think. Though that doesn't seem documented, and anyways, I'm not sure I could access the pins needed for changing boot modes.

So, there's no way to unbrick this other than reprogramming the flash chip, right? The parallel flash chip has way too many connections to make that reasonable without specific tools.

I guess I should give up, right? There's no easy way to fix this.