These are just general notes from my reverse engineering efforts. No effort has been made to present them in a tidy manner, expect a write-up later.

• The display is connected to DI0 *NOT* DI1 as I had previously assumed.
• Backlight is wired into PWM unit #1. Freescale intended the PWM modules for audio use but in this case that isn't what's happening. From what I can tell Freescale did a similar thing on one of their development boards, as there's a PWM based backlight driver in the Windows CE BSP for the MX50 EVK. I have ported this to the MX51 BSP, and it works fine.
• Suspect that PMIC CS line is connected to GPIO16, based on this snippet
  

  STMFD   SP!, {R4,LR}
  MOV     R4, 0x73F84FFF  ; GPIO
  MOV     R1, #0
  MOV     R2, R1
  MOV     R0, #0x1F       ; regulator setting 1
  LDR     R12, [R4,#-0xFFB] ; GPIO1 Direction Register
  ORR     R12, R12, #0x10000 ; GPIO16 - Output
  STR     R12, [R4,#-0xFFB]
  LDR     R3, [R4,#-0xFFF] ; GPIO1 Data Register
  ORR     R3, R3, #0x10000 ; GPIO16 = On
  STR     R3, [R4,#-0xFFF]
  BL      write_pmic_     ; R0 = Register to use
                          ; R1 = Value to write
                          ; R2 = Write/_Read

• Red/Green status leds are wired into the respective Red/Green channels on the MC13892's LED driver. Blue does not appear to be connected
• Wireless is provided by a Gemtek GB86321G. This is a combination WiFi/Bluetooth. WiFi is exposed over SDIO, Bluetooth is a simple UART interface that should be wired direct to the SoC but I have not tested this. Datasheet here: http://www.gigafu.com.tw/upload/2015Jan/pdf/20150116150715408944481_1.pdf
• DECT setup is very different to the scheme used in the previous platform. Was previously connected over a USB host to a separate module but is now done using an on-board PNX8099 which I assume is a generic microprocessor. This appears to have been connected over SPI but probably has numerous other tie ins to GPIO. No data available. This will need extensive logic analysis to figure out. The PNX8099 has a small EEPROM (24C series) that I will dump later. Probably just has some serial numbers etc, it isn't big enough for firmware.
• A 24C256 EEPROM contains the system serial number and some other details, including copies of the boot string. A dump will be attached shortly.
• LCD fitted to the unit is a FG0700G3DSSWBG01 by Data Image. Datasheet here: http://www.bfdisplay.fr/fiches-techniques/ecrans-tft/dataimage-FG0700G3DSSWBG01.pdf
• Getting one-time access to the downloader from JTAG is easy. Connect the JTAG probe, start OpenOCD and halt the board. Disable the MMU with "mmud", then set the PC to an invalid value "reg pc 123". Resume the target and the board should crash and enter the downloader. This prevents needing to screw around with erasing or shorting out FLASH pins.