You got that right. It must be spi since There is some spi routine that seems do nothing. I guess some data is exchanged between the chips, or some initialization is commanded. Which means cpu can command the IC "C" with re configuration on the fly.

You did some pretty good hacking job already. Maybe I can try to map the data with disassembly and will get really good sense of some of the stuff.