Well the burnt traces were discouraging but a big part of the reason I bought the DMMs was for the challenge of making a repair. One of them spontaneously fixed itself so...
First things first, I checked the power supply - immediate score! The -18V rail was out of spec - unfortunately it was running at over -36V i.e. unregulated transformer voltage. This is potentially a very bad thing, as anything on the -18V and -15V rails will have taken some serious abuse. This includes the display, which I decided to tackle first so I could at least confirm if the main controller was running and read out the error codes.
The display logic runs between -18V and analog ground, so the nominal 18V input had been doubled by the fault. On the display board this supply is regulated down to 5V for the logic, but this local 5V rail was down at around 0V, showing a near short to ground with signs of heat damage to an inductor. Desoldering the VFD to allow for further investigation revealed the ugly truth - the 5V regulator (78L05, or something similar), much like the LM337T on the -18V mainboard rail, had failed by shorting input to output, letting through the unregulated supply voltage. This had cooked the inductor, leaving it open circuit, but not before destroying, amongst other things, the display processor. The only thing which may be salvageable is the VFD itself, which at least showed all the segments lit up, though its brightness is suspect given that it was being supplied by about 150% of its nominal voltage. I pretty much decided to write-off the display board at this point, however the main board could be tested by swapping in the display from the working DMM.
Suprisingly the burnt unit booted up with swapped display, and the 3 start-up beeps were reduced to 2 (i.e. the second double beep had become a single beep). Less surprisingly, the DMM reported error 604, which is ADC related, which also meant that it had to skip the rest of the self test, at least for the tests which rely on the ADC value. I decided to get the ADC working so that the rest of the self test could be completed. This is where I made my first big mistake - not properly reading, and more importantly, understanding the service manual and schematic. I should have first checked that the ADC input was sensible - ideally near zero, as that is what error 604 actually means - it was expecting zero and was getting something else. As it turned out, the ADC integrator op amps actually were cooked, but even after I replaced them (twice) it was still flagging a 604 error. 'scoping things out showed that the integrator output was not ramping as expected, being stuck at the negative rail. I had pretty much pulled out all my hair before noticing that the service manual states that the integrator can get stuck at one rail or the other if the input is out of range. Sure enough, the input to the ADC was at +18V. Incidentally, trying to troubleshoot the newly replaced op-amps introduced me to something I've never seen before - op-amp overload recovery time. Annoyingly this can make a perfectly good op-amp look like it has failed. Anyway, once I'd forced the ADC input to 0 then the integrator recovered and the expected output ramp output around +2.5V was seen. This cleared error 604... and of course led to a long list of other self test errors due to me forcing the DC amplifier output to zero.
I believe this main board is pretty much the latest layout, as unlike the older, working meter, which has a USA made mainboard with no silkscreen and dual JFET DC amplifier input, this board is made is Malaysia, has almost full component labelling in the silkscreen, and has replaced the dual jfet with a bootstrapped OPA130. This is pretty annoying as I cant find the full schematics online, but it looks like someone in China has posted a reverse engineered schematic. As far as I can tell, this reversed schematic is pretty accurate, although doesn't include the correct designators/labels, and the resolution is so low that is it almost illegible. I've added designators to part of it and attached it below in case anyone finds it useful. Can't guarantee that it's correct but it's probably a good place to start.
One of the main functions of the DC amplifier is the decade range selection, achieved by switching the negative feedback resistors. The reason for the saturated input to the ADC turned out to be lack of any feedback at all. The resistors themselves were fine but feedback switching is done by the custom agilent "switch chip", one of the chips which reside across the +18V to -18V rails - it looks like this hadn't survived the +18V to -36V excursion. Sadly these are no longer available from Keysight, at least according to the questionably named official Keysight FAP (find a part) website, so this is where I am currently stuck. I confess to having splurged on an Aliexpress "genuine" replacement, but it will be at least a few weeks before it comes in and I figure that there is only about a 50% chance it will actually work, but I've spent enough energy on this project that I figure it is worth a gamble. Hopefully I will be able to add more to this thread when it arrives...