FPGA stands in the way, concealing those pins. From CPU side I can see that BW option is defined by bits 3..0 of F6000004 reg:
1 - 100MHz
2 - 300MHz
4 - 500MHz
8 - 1GHz.
Other bits there:
7..6 are number of channels:
1 - 2CH
2 - 4CH
14..10 are instrument family and some other features:
0 - MSO 0 (TBD)
1 - DSO 2
2 - MSO 2
4 - MSO 1
8 - MSO 0 with battery
16-MSO 2 with serial keyboard
families: there are 3 major instrument families selected by bits above, bandwidth bits selects an instrument inside that family:
0: 5462x (never selected), 5464x (never selected), 601x, 603x, 605x, 610x
1: 601x, 603x, 605x, 610x
2: 703x, 705x, 710x, 501x (DSO only), 503x (DSO only), 505x (DSO only)
Carrington's F6000004 dumps:
6034 - 2A2 : bits 14..10=0 -> MSO family 0, bits 7..6=2 -> 4CH, bits 3..0=2 -> 300MHz
6104 - 2A8 : bits 14..10=0 -> MSO family 0, bits 7..6=2 -> 4CH, bits 3..0=8 -> 1GHz
It's hard to say anything about pins based on this: definitely these bits doesn't reflect pins states directly (note changing center right resistor results in 2 or 8 value in 3..0), must be some binary to one-hot decoders. I can try bitstream decompiler next week (I'm away from my bigger PCs now), but that Spartan-3 device is pretty huge, so I'll need some infos to identify that specific part of logic somehow: first is F6000000 register value (0, not 4, this is hardcoded bitstream revision reg) - this can help identifying register bus in general, second is our left/right resistors FPGA pin locations (there are vias to all FPGA pins on the back board side, so a quick sweep with a DMM beeper can identify both pins) - these should lead to straps sensing logic directly.
Another interesting possibility is obtaining different models FPGA pins snapshots with JTAG SAMPLE instruction, then comparing. Sure, there will be many dynamic pins, but they can be filtered out by taking many dumps on the same model and ruling out all changes. This can be hard if done by hand, but pretty easy if programmed.