Steve, you use IDA? I can upload both halves of my disassembly, be easier to explain things that way. my P66 V6 ADX has some mode4 stuff in it already but I have more defined in the disassemblies than what I have in the ADX.

stuff I can answer off-hand: the T-side does primary communications, mode4 stuff is passed to E-side over SPI. E-side mode4 bytes are 360-366, T-side mode4 bytes are 34A-355. I've got a decent amount of both decoded.

BLM cells are located from 100-142 on E-side(an odd byte exists between the cell groupings, it might be an idle only cell?). 100-10F are Right/Rear O2 sensor with CCP active BLM cells(1-16), 111-120 is " .... " with no CCP, 122-131 is Left/Front O2 sensor with CCP active, 133-142 is " ...... " with no CCP.