Well, I think the Bluetooth chip might have been ok after all - but I don't feel bad, because without removing it you couldn't tell what some signals were.
I've updated the CN8 image in the post above this one.. Pin 1 is most probably just 3.3v (which also goes to the enable pins for the voltage regulators on the Bluetooth chip). Pin 2 is still a mystery - working board shows a low signal, see the 3rd analyser line in the following image. The 4th analyser line is pin 3 - it's a reset line coming from the main CPU (this I would never have known without removing the BT chip). Top two lines are Tx and Rx (BT chip). You can see it becomes active when reset by the main CPU.
I also found this gem - the B version chip matches what's in this screen - so I finally have a bit more information to use...
So testing the reset lines of the iThing chip (4th output shown) and the video chip (3rd output - this chip is on the same 2 wire bus) - you can see they are resetting the two devices in a very specific way (2 wire busses can get out of sync otherwise).
The broken board never raises the iThing chip's reset line (middle of image) which is meant to happen about 1 second after Bluetooth makes the connection (two top outputs).
Logic would say the video (being enabled at that point) is causing an issue - but with exhaustive testing, video only becomes active on the reset that happens 2/3rds along on the 3rd output.
It's a real mystery what else is happening on the board at this time - audio has already been configured (but also gets more config written after the 2nd BT connection takes place). Touch screen is fairly consistent as shown before. USB is done and dusted way earlier and never generates signals again unless something is plugged in.
Thinking video was the last thing that became active, I changed the flags via the
CAN BUS to disable everything (reverse cam, touch screen, park assist). Nothing helped though.
It does just now occur to me - maybe the main unit is attempting to read the flags out of the smaller board and is getting stuck - this is about the point it would want to know if the reverse camera is installed?