Some more observations:
As the problem was from the start caused by the firmware (so the code in the flashroms), and i'm sure that the code previously was correct on the flashroms, i'm starting to think that wasn't in the nvram code and neither the eprom code the problem, but something between the cpu and the flashroms.
I ignore what was the error of the jumpcode, but i think something inside the flash. Searching the net about this error i've found someone that without firmface board got
Flashrom Header failed: Bad jumpcode = 0xffffffff, should be 0x4e714ef9
So as my error was simply a one bit error(asked 0x4e714ef9 received 0x4f714ef9) seemed like there was one data line of the 32bit bus not working (Next try is to boot the scope without firmface to see the error)
After the flash of the new firmware version, that error has gone.
When there was one chip programmed badly, it was not passing the crc check of the header of the firmware (that can be caused also by a data line not working), but after have found the falsh ic with the wrong code, also that error has gone.
So in some way (that i really not understand) the data bus problem has fixed itself, else wasn't possible to compute a crc check. I suspect that the crc of each section is in the flash (in well known locations), and it compare the crc stored with the one calculated from the other memory locations (for now i've seen header and body).
So, the error that i have now about the crc of the body (that seem read after the header) can be caused by the firmware files that are not ok (as now i'm sure that the flash content is double check verified against the downloaded files).
In any case i've checked if the data and address line a0...23 and d0...31) from the buffers to the firmware board and are all ok and (now) no lines are interrupted.
The firmware that i've downloaded must be ok in some ways (as the header crc is well computed) but there must be some problem somewhere else.
At this point, someone that know well this infernal thing, can confirm my toughts?
And also, where i can find a secure way to obtain the firmware files (maybe of firmware 2.16e) for my tds540?
Seem that it's easy to obtain via gpib, i've seen a script that can do it easily.
Someone, please, can help me a bit to fix this scope? I really not like the idea to give up.