Wow, that was alot of work, but I solved my problem.
TL;DR:
The version of BG7TBL GPSDO I have uses two TIMEPULSE outputs (One at the regular PPS position, the second on U-Blox footprint position 1).
The problem on my board was that SAFEBOOT_N signal is shared with TIMEPULSE on pin 1, and the pin was pulled low at GPS boot, forcing it into this strange mode.
I finally solved it by strapping a 100Ohm resistor pull-up to 3.3V and now my GPS boots again.
The longer story:
I got myself a second u-blox GPS, a gen 6 (easily available from many sources). I thought I could swap the GPS blocks and replace my bad one
.
I desisted from throwing the NEO7 block in the recycling bin and decided to solder it to the breakout board I got with the Neo6.
To my amazement, the Neo7 which I believed to be broken booted up when I plugged that in and started looking for satellites and it got a fix after a while.
I thought perhaps this was due to some reflow of the soldering on the GPS daughterboard, so I sat down and swapped the GPS's again.
However, when I plugged in the GPSDO it was back at the strange baud rate and no joy.
I then took a better look at what could be different between the two boards, and the Neo6 has an external I2C flash, so I thought that might mean that my Neo7 accept a I2C flash on the same pins. I spent some hours studying the boot data on the Neo6 and tried replicating it with an arduino in I2C slave mode I had lying around, strapped that in to the same pins, but the traffic generated by the I2C/DDC pins was not correct I2C transactions.
Finally I arrived at the solution, and jumpered the TIMEPULSE2 / SAFEBOOT_N pin to 3.3V and turned it on, lo and behold - 9600baud data on the UART. It was this pin that was preventing the GPS from booting up.
Its been an interesting investigation, thats what hobby is all about
Just wanted to share if anybody runs into a similar issue.
Best regards