I was able to trace down the serial port and JTAG lines using a dead (or at least now it is) Zune board. These can be accessed on the exposed 20 pin header on the unpopulated side of the board, with the opening facing you.
Serial
Rx - 4
Tx - 5
JTAG
TRST - 8
TDI - 9
TMS - 10
TCK - 11
TDO - 13
Power
+3.3 - 6
GND - 17,18,19,20
Possibilities: Watch boot / operation sequence over serial console or JTAG, reprogram the boot rom with something more generic... Anyone willing to do this? I just sacrificed my Zune :(
Bookmark and check this page for updates. I just wanted to post the quick and dirty information.