I debugged a boot issue on the Apple Newton this way. The latest flash image was a brick on production hardware (no available LEDs, GPIOs, etc.) but not on development hardware. But I could flash a new OS image.
So I wrote some small loops that did different stuff on the bus (so that they sounded different) and salted the boot path with them, then listened in on my portable AM radio. Found the problem inside of an hour by moving the loops further down the path.
There were probably other ways to do this (could have coaxed a hardware tech in the lab to solder in a GPIO), but this way was more fun. :-)
Reminds me of the CHDK hackers trying to dump firmware off a Canon camera. They could get the altered firmware to activate and could read memory and control an LED, so... they blinked the firmware out through the LED, and read it with a ball mouse's optical sensor attached to a microphone cord. :-)
IIRC it was some improperly guarded code that was intended to run only on the non-production development systems (some debugging support). The kernel would touch a non-existent h/w register and trap, which was fatal. Removing the code was the fix.
So I wrote some small loops that did different stuff on the bus (so that they sounded different) and salted the boot path with them, then listened in on my portable AM radio. Found the problem inside of an hour by moving the loops further down the path.
There were probably other ways to do this (could have coaxed a hardware tech in the lab to solder in a GPIO), but this way was more fun. :-)