I have successfully compiled a S9 bootloader and can program the S9 with tcctool. Right now I simply have a copy of the D2 firmware with SD support disabled. I am using the arm-eabi toolchain.
Using mktccboot to create a "dual-boot", I find that the S9 is completely dead - it will not show up in lsusb and doesn't read the lock status correctly to boot into the manufacturer firmware.
Writing the bootloader directly to the S9 with tcctool is interesting: it locks up my USB driver, so that if the player is plugged in, lsusb (and usbmon, and usbdev, and ...) will simply hang until I unplug the player.
There is a thread on iaudiophile
about this (I am posting as joeyg). It looks like nobody else has gotten this far - others have bricked players that they cannot get back. If you have any information about bricking and unbricking S9's, please let me know.