Thanks so much. The “java -jar ocf-cc.jar” didn’t include an icon in my tray, so I tried the -w option which did open a log window with the Reader Configuration screen. Note that the HSM (serial number) names shown in that screen were the original versions before the working one was updated yesterday (a bit confusing). However this worked and I was able to reload the firmware on the locked HSM!
Thanks again for all the help. I know it was an odd situation (remote server with 2 HSM) but the portal got me out of a jam.
I think this confusion is temporary - I remember seeing the mismatch between the reader serial number and the token serial number after the upgrade, but now I have checked one of my tokens updated sometime ago - and all the serial numbers (reported by USB as well as the PKCS#11 interface) seem to be in sync.