I was in about the same boat last week with a brand new system. This is what we were able to do:
– logoff from console session
– set system to manual mode on control panel
– issue function 21 on control panel
– now you can change QSECOFR DST password
– when in DST, select 13 “work with system security”
– change 3rd parameter from 2 to 1 to avoid this problem, or leave it as a security feature 🙂
if you are using ACS on the PC, If you plug it directly into the non-HMC RJ45 port, you can use the scan tool in the product to find the console address. There is a sequence of 65-21-11 you may need to perform if you need to change the system to a LAN CONSOLE.