I have completed code to generate the long mode $36 download frames. Can't thank kur4o enough for the help...

Starting with the details of a correct frame...
Code:
{6D 10 F0 36 [[80 (00 70) (00 18 10) //86 86 36 CE 76 80 3C 30 9D 86 38 31 39 18 38 18 EC 02 FD 18 7C CD EE 00 18 08 18 08 18 08 18 08 4F 9D 8F C6 40 E7 00 18 E6 00 E7 00 FB 18 7F F7 18 7F 24 03 7C 18 7E 9D 89 C6 C0 E7 00 9D 8C 18 E6 00 E1 00 27 07 4C 81 19 23 D6 20 12 08 18 08 3C FE 18 7C 09 FF 18 7C 38 26 C5 86 86 20 02 86 85 36 CE 76 80 3C 30 9D 86 38 31 39 00 00 00 00//]]  [29 0A]}  [56]


Here is some sample mode 36 message. 
MODE is 36 80 it could be 36 00 also. It depends on pcm. 80 means download and execute. 00 means download only. Some PCMs don`t support multi message download and they execute on both 00 or 80. 
(00 70) is the lenght of the message. The message lenght is contained between //...//
(00 18 10) is the ram address you want the message to get loaded. It  is always 3 byte length.
[29 0A] this is the block checksum. It is used by the pcm to check data integrity. It is word+word+word 16 bit type checksum caculated from data contained in[[.....]]
[56] this the checksum of DLC. it is calculated from data contained in {....}
this is 8-bit CRC with the following attributes

I generated an assembler source file for the content of that frame. This represents the code we expected to be downloaded. This means that the header, mode and parameters along with the checksum and crc bytes are removed from the source code. Origin is set to match what I see in the frame.
Code:
	ORG $1810
	;DB  $6D  Header is re-generated by the program
	;DB  $10  
	;DB  $F0  
	;DB  $36  
	;DB  $80  
	;DB  $00  
	;DB  $70  
	;DB  $00  
	;DB  $18  
	;DB  $10  
START	DB  $86  
	DB  $86  
	DB  $36  
	DB  $CE  
	DB  $76  
	DB  $80  
	DB  $3C  
	DB  $30  
	DB  $9D  
	DB  $86  
	DB  $38  
	DB  $31  
	DB  $39  
	DB  $18  
	DB  $38  
	DB  $18  
	DB  $EC  
	DB  $02  
	DB  $FD  
	DB  $18  
	DB  $7C  
	DB  $CD  
	DB  $EE  
	DB  $00  
	DB  $18  
	DB  $08  
	DB  $18  
	DB  $08  
	DB  $18  
	DB  $08  
	DB  $18  
	DB  $08  
	DB  $4F  
	DB  $9D  
	DB  $8F  
	DB  $C6  
	DB  $40  
	DB  $E7  
	DB  $00  
	DB  $18  
	DB  $E6  
	DB  $00  
	DB  $E7  
	DB  $00  
	DB  $FB  
	DB  $18  
	DB  $7F  
	DB  $F7  
	DB  $18  
	DB  $7F  
	DB  $24  
	DB  $03  
	DB  $7C  
	DB  $18  
	DB  $7E  
	DB  $9D  
	DB  $89  
	DB  $C6  
	DB  $C0  
	DB  $E7  
	DB  $00  
	DB  $9D  
	DB  $8C  
	DB  $18  
	DB  $E6  
	DB  $00  
	DB  $E1  
	DB  $00  
	DB  $27  
	DB  $07  
	DB  $4C  
	DB  $81  
	DB  $19  
	DB  $23  
	DB  $D6  
	DB  $20  
	DB  $12  
	DB  $08  
	DB  $18  
	DB  $08  
	DB  $3C  
	DB  $FE  
	DB  $18  
	DB  $7C  
	DB  $09  
	DB  $FF  
	DB  $18  
	DB  $7C  
	DB  $38  
	DB  $26  
	DB  $C5  
	DB  $86  
	DB  $86  
	DB  $20  
	DB  $02  
	DB  $86  
	DB  $85  
	DB  $36  
	DB  $CE  
	DB  $76  
	DB  $80  
	DB  $3C  
	DB  $30  
	DB  $9D  
	DB  $86  
	DB  $38  
	DB  $31  
	DB  $39  
	DB  $00  
	DB  $00  
	DB  $00  
	DB  $00  
	;DB  $29  Checksum is regenerated by the program
	;DB  $0A  
	;DB  $56  CRC is regenerated by the program
	END     START;	end of program with start address specified
Assembling that code, we come up with the Srecord (.S19) file that we want to turn into a frame...
Code:
S1231810868636CE76803C309D86383139183818EC02FD187CCDEE0018081808180818085B
S12318304F9D8FC640E70018E600E700FB187FF7187F24037C187E9D89C6C0E7009D8C181A
S1231850E600E10027074C811923D620120818083CFE187C09FF187C3826C5868620028605
S11318708536CE76803C309D8638313900000000B4
S9031810D4
The Srecord file is input to the frame generator code... output looks like this
Code:
Input file opened

Line: 1  Byte count: 75
Record type: S1 found
Record length: 0x23
Record address: 0x1810
86 86 36 ce 76 80 3c 30 9d 86 38 31 39 18 38 18
ec 02 fd 18 7c cd ee 00 18 08 18 08 18 08 18 08

Checksum: 0x5b

Line: 2  Byte count: 4b
Record type: S1 found
Record length: 0x23
Record address: 0x1830
4f 9d 8f c6 40 e7 00 18 e6 00 e7 00 fb 18 7f f7
18 7f 24 03 7c 18 7e 9d 89 c6 c0 e7 00 9d 8c 18

Checksum: 0x1a

Line: 3  Byte count: 4b
Record type: S1 found
Record length: 0x23
Record address: 0x1850
e6 00 e1 00 27 07 4c 81 19 23 d6 20 12 08 18 08
3c fe 18 7c 09 ff 18 7c 38 26 c5 86 86 20 02 86

Checksum: 0x05

Line: 4  Byte count: 2b
Record type: S1 found
Record length: 0x13
Record address: 0x1870
85 36 ce 76 80 3c 30 9d 86 38 31 39 00 00 00 00

Checksum: 0xb4

Line: 5  Byte count: b
Record type: S9 found
Record length: 0x3
Record address: 0x1810
Srecord indicated execution start address: 0x1810

Frame content:
6d 10 f0 36 80 00 70 00 18 10 86 86 36 ce 76 80
3c 30 9d 86 38 31 39 18 38 18 ec 02 fd 18 7c cd
ee 00 18 08 18 08 18 08 18 08 4f 9d 8f c6 40 e7
00 18 e6 00 e7 00 fb 18 7f f7 18 7f 24 03 7c 18
7e 9d 89 c6 c0 e7 00 9d 8c 18 e6 00 e1 00 27 07
4c 81 19 23 d6 20 12 08 18 08 3c fe 18 7c 09 ff
18 7c 38 26 c5 86 86 20 02 86 85 36 ce 76 80 3c
30 9d 86 38 31 39 00 00 00 00 29 0a 56

Since the output frame matches the original example frame, I think all the code that adds headers, mode and parameters, checksum and CRC is well tested.
Using this frame generator we can write 6811 code, assemble it to Srecords, make a mode 36 frame. That frame can then be used to download the PCM.

I am happy to share all code, but the archive of the visual studio project is quite large (27M). I am not sure a file that large should be loaded here (?)
Let me know what would be of use. The actual source is quite small and the exe is tiny.

I will make a example program the standard "Hello World" to download. Then it is on to figuring out how to bash bits to get around limits of the ELM327

-Tom