[JasonACT]

CANBUS seems fine, all the data blocks read out fine too on the broken board. They are stored on the smaller board, which has been confirmed to work with my working large board. The two small chips that interface the CANBUS chip to the large connector where the smaller board plugs in also show activity "on both sides" of them with my logic analyser. Not sure if they are level changing gates or tri-state or just drivers, but that whole part seems to work well.

I'll have to find out what the uart messages mean that are going to and from the Bluetooth chip, maybe (even though both boards have identical command/response data) it's a start-up command which triggers another i/o data line which is being waited for - but never happens on the broken board?

You know, it makes sense that a firmware upgrade (we know they upgraded Bluetooth back in 2013/14) could unbrick a board - but while the screen starts working again, you are left unable to connect to Bluetooth. New firmware might just ignore errors when the old one waited indefinitely?