Good news: I decoded a few more commands. The v2 and v3 firmware seem to have identical commands.
Bad news: Some things are done internally by the programmer (namely, big reads and writes) and it seems you can't influence the actual SPI commands for that. It is unclear whether commands bigger than 4 bytes can be sent (i.e. writes). It is unclear whether more than 4 bytes of chip response can be read. Some commands are still totally undecoded (one is probably IDLE and another one RESET, but that's pretty much speculation).
I know how to test my assumptions, though.
AFAIK the Dediprog can do "fast" (partial) writes. A log from such a partial write (i.e. zero out some area that was 0xff before) would clear up a lot of stuff.
Separate logs from ID/read with changed frequencies (one log per frequency) would help as well.
What else can be set? Voltage? Timing? Other stuff?
Regards, Carl-Daniel