I don't have much test gear, so I need to make due with what I've got. In the end I used this glorious mess to generate a 1-kHz sine wave and send it to the scanner over-the-air:

The function generator sends a 1-kHz sine wave 30-mVpp out to the Baofeng mic jack over a 3.5-mm extension cable. The Baofeng is set to 146.420 MHz, a simplex frequency in the 2-meter band. I replaced the antenna with my Li'l Dummy dummy load, just to keep radiation to a minimum. I added that frequency to my scanner, and when I key up I get a nice pure tone out of the speaker. I also make sure I identify myself, just in case my signal is getting out of the shack.

So now I have a test signal. What I don't know is how hard to drive the Baofeng. I did some Googling and 30 mV p-p seems reasonable for an electret mic like the Baofeng uses, but it's just a guess. More research needed.

Next steps:

• Set the scanner up to pipe this signal to the REC OUT jack
• Measure the signal between shank and tip of the extension on the REC OUT with my oscilloscope
• Measure the signal at TP6 on the BE dock with my oscilloscope
• Set up my other Baofeng -- you can't have just one -- to receive this signal and hook it up to the dock
• Repeat measurement using Baofeng rather than scanner and compare everything.