Fluke 97 kernel test anomaly

[Maxis]

Hello Dear forum members,

I've recently acquired Philips PM97 (Fluke 97) scopemeter in a hope to get it fixed. It dates back to 1992.

It has a very fuzzy display (completely unreadable and not stable). As usual 4 aluminum caps replaced and the acid damage was repaired, LCD bias circuit also repaired, uP board LCD digital logic tests+power supply tests were done. Observations: by design the scopemeter runs not at 5.00V, but at 5.321V. The resistor network and the placement of components is not exactly the same like in the service manual in the secondary power supply section.

Before bashing zebra strips, I was thinking about video RAM buffer (D1206) being likely damaged and possibility to test it. And here is a puzzling bit.

When I run the kernel test by shortening TP216 to GND the scopemeter follows what's written in the manual with "walking" zeros on AD0..AD15 on every TP217 grounding.
But then, on the 16th TP217 action, instead of testing just the D1204 RAM and reporting test results, my PM97 tests both D1204 and D1206 
This test reports PASS (pin6 of the X1201 I see 0.5s toggling).
On the 17th grounding of TP217, the XON is sent. However, the D1206 chip select remains high (no second RAM test is performed) and pin6 of X1201 is not toggling any more but held LOW (showing that this is the end of tests or maybe crashing). This doesn't indicate the error, but likely it indicates a different ROM mask version not the same as described in the Service manual.

By grounding after that TP216 doesn't help o-scope going back to the normal operation interrupting the kernel test. The o-scope is stuck and only toggling ON/OFF will bring it back to normal (still very fuzzy LCD but full response to the buttons).

My question is: have anyone observed so far the same behavior of KERNEL TEST?
My dilemma is: it's either the RAM anomaly which crashes the test (still produces a good test because of XON being sent and pin6 of X1201 is held low), or the older ROM MASK FW with algorithm different than mentioned in the manual.

The MCS96 ROM mask is LCDS0 ver 2.01

One more question, have anyone already successfully performed the DFU? It seems like there is a way to backup the calibration constants and reflash the more recent FW. For that the tool is needed (likely running under DOS/win3.11). Does anyone has this tool?

Thank you for your help.