The TMP89FM42 has a Serial PROM bootloader mode: pull MODE high at reset and it speaks UART at whatever baud rate you open with. No official programmer needed — in theory.

An Arduino UNO became the programmer (AltSoftSerial for jitter-free timing; regular SoftwareSerial corrupted bytes — 0x63 arriving as 0xE3). Getting the protocol right took longer than the wiring:

• The protocol is byte-by-byte interactive. Send a byte, wait for the echo, send the next. Send a whole frame at once and the chip ignores you. The datasheet does not say this anywhere.
• Every session starts with two magic bytes (0x86 for baud detection, then 0x79), then a command byte.
• Addresses and lengths are 3 bytes each — on a chip with a 16-bit address space.
• Any error drops the chip into a silent idle state. A password error doesn't even send an error code. Reset, start over.

That last one mattered, because the original firmware is password protected. The read command requires two magic addresses (where the password length and password string live in flash) — get them wrong and the chip just goes quiet. I scanned dozens of plausible locations. Nothing. Samsung's firmware wasn't coming out.

Fortunately I never wanted it — a chip erase wipes the flash and the security along with it. Blank chip, fully writable, mine now.

The Arduino sketch and a Python driver script now do the whole cycle unattended: enter PROM mode, erase, stream the Intel HEX, verify the checksum, reboot. Protocol notes (including the undocumented behaviors) are in the GitHub repo.