MT8168 BROM Entry Guidance

I’m opening up a Score 7T (Keefe Group) tablet built on the MediaTek MT8168, board id tb8168p1_bsp, and I need to force it into BROM mode by shorting the correct test points on the motherboard. I’ve done a few hardware-point jobs before, so I understand basic safety and ESD practice, but I want to follow an exact, proven sequence this time.

What I expect from you
• A clear, step-by-step set of written instructions—my preferred format—covering disassembly, test-point identification (CLK/DAT0 or any pad combination that actually works on this board), timing of the short, and verification with mtkclient.
• High-resolution reference photos or annotated diagrams of the Score 7T PCB highlighting the precise spots to short.
• Any firmware-side preparation or mtkclient command line you routinely use to confirm the device has dropped into BROM.
• Brief proof of similar MediaTek jobs you have successfully completed so I can see your approach in action.

I already have mtkclient set up and I’m comfortable with USB-TTL adapters and standard tooling; what I’m missing is the insider knowledge of the MT8168 test points and the exact boot sequence timing. If this is familiar territory for you, let’s get this tablet talking in BROM and move on to the fun part.