For your part, no need to backup and restore it. Because no SWD interface(development kit(EVK) have) support you to restore it.
So we recommend only normal operations on your part, it is dangerous for you if you want to change the detailed boot loader and FW codes and try self-defined FW in it. if bricked, difficult to restore it and may be you need to back plant for restore again.
We recommend self-define FW testing during developing period on EVK part, on EVK:

1. You can backup easily
2. restore easily
   3.debug FW step by step with ST-Link.
   hope clearly for you

yes, the packetrate can be adjusted and saved in source code.
but ecuAddress seems can not changed to 0x83, 0x85,...., maybe you can try and test to confirm it is a problem

the biggest frequency of all 300RI packets is 100hz, so i do not think it is from 300RI, i doubt it is caused by other nodes or other abnormal CAN tools SW setting.
any other node in CAN-net work? is it possible other nodes send the '000'-ID out?
power off 300RI after 2-3s, and then check '000'-ID is still received or not?

Generally in UserAlgorithm.c, you will find:
static uint8_t algoType = AHRS;
it means heading calculation from mag, pls check.
Already enabled in VG_AHRS app on ANS( developers.aceinna.com/code/apps), you can test.
Just a reminder, we didn't calibrated the 300ZI mag in plant, for mag is too easy influenced by environment. and you need to calibrated by your self if you need, steps in topic_11(https://forum.aceinna.com/topic/93/top-topics-of-common-operations-with-openimu-products/2)

Pls refer to SW protocal of UART/SPI:
https://openimu.readthedocs.io/en/latest/software.html#openimu-software-support
HW interface as:
https://openimu.readthedocs.io/en/latest/OpenIMU_Modules.html#openimu-modules

@rintaro if it worked and will give feedback, if not you need change the baud rate and try again:

SW/Algorithm Reset generally no problem, cannot lead output data 0.

I still want to know what other actions you had done? e.g. send some commands to IMU.
for the CAL/CONF area may be already broken, but generally you cannot break it only by boot loader(boot loaderworking fine now) except some special commands received. or it can be recover well.
so i need time to find solution to recover your CAL/CONF area, working on it.
if you have other more information, pls let me know.

@rintaro you need to do:

• send commands to 300RI to lock one sector of the Unit, by UART.
  

• power off and on, running with python diver and connected by ANS web page. maybe you need to change the packet rate, and click play button. check whether some data output.
  

• after connected by ANS web, pls upgrade to below app, then power off an on, check how the status is in your side.
  

still find solution, still need more time, I can't reproduce your phenomenon now.

@akofler I had finished the 300RI...109 bin file preparation and shared with you, pls follow the topic_4 steps, note that just starting from unlock step and then upload/lock steps followed.

109_with_VG_AHRS.bin

You are welcome.
Reminder for IMU330/300 SPI users: from SPI part in online manual

• configurations: IMU working in SPI mode; SPI mode 3(CPOL = 1 (polarity) and CPHA = 1 (phase)); Data is transmitted 16-bits words, Most Significant Bit (MSB) first;
• read and write register sequence:
  
  
• Follow the timing applies at system startup: