Like the Raspberry π SoC is based on a television tuner box. The vast majority of the die is related to the TV tuner functions that are completely undocumented. What techniques exist to explore undocumented physical hardware? Are we limited to reverse engineering code to find when and how these undocumented areas are used, or are there other fuzzing type techniques to find relationships between memory, flags, and potential byte instructions?
This is an abstract thought and generalization that potentially patches a hole in my understanding. There is no broader purpose in asking.
This is an extremely high level answer, but you have to be equipped to even notice whatever it was did when you twiddled it. It might not be obvious, and this is muddied by the fact that most of the reserved or undocumented bits/registers/addresses/pins will probably do nothing. Or crash the machine. So that entails having a vague idea of what the device might be capable of in the first place so you can have the right equipment or software hooked up to it to even observe results. There’s probably no automated programmatic way to do that in most cases.
It’s bad enough when all you have in front of you is a microcontroller that can only manipulate its own memory and a small easily defined set of outputs. It gets hairy fast when you have multiple special purpose chips in a system that could do anything.