MarkL,
Next time can you try a simple test - try to heat the 25MHz oscillator with hot air pencil or soldering gun , and cool with dust blower or a piece of metal cured in the freezer for a few min and watch the CP pin if it shows any sign of the PLL trying to lock, or if we are lucky it may even lock. That would indicate either the oscillator may be off of the spec frequency or the loop filter bandwidth may be too narrow.
Great suggestion - I tried it.
There is sensitivity to temperature. The hotter it gets with an air pencil, the less deviation in the modulation. The colder with freeze spray, the wider the deviation. I was not able to get it hot enough to lock, but I didn't heat it beyond about 100C.
A better test would be to unsolder the DC blocking cap between the 25MHz oscillator and PLL and connect an external signal gen there (DC blocked) and vary the frequency slightly and see if the PLL locks. That is only if you willing to touch the board with solder.
If we were beyond the 30-day return window, I would go at it in an instant.
If this problem has no resolution within the return window, it's going back. I've learned the lesson that what you see in front of you is what you're buying, especially with this lower end stuff. I wouldn't blame Rigol in the least for not taking it back once the modding started.
That being said, I'm going to see if I can find a spec sheet for the oscillator on the off-chance that one of those pads is an output enable.