I opened up my DSO2004 for a bit of a poke around.
Just a heads-up for anyone who wants to try playing around with JTAG - I think the convenient looking pin-header that Dave highlighted in his tear-down is not, in fact, a JTAG port. At least it doesn't seem to be directly connected to the appropriate CPU pins. Instead, if you want to hook up to the CPU's JTAG interface, there are 8 neatly spaced, slightly larger than typical, VIAs just above the CPU (between it and the flash). Those appear to be hooked up to the JTAG pins, and there are also some resistors/unpopulated-pads which look like they're connected to the config pins on the CPU.
I didn't go to the trouble of actually working out which pin was which, nor what the config pins default to (it's possible you'd need to change the resistors around if you want to enable JTAG), but if you're looking, that's where I'd start...
I didn't explore the JTAG pads over by the ASIC - not sure if they're chained up to the CPU or not, and I suspect the CPU JTAG is of more interest.
However it's late here, and I'm tired, and I wanted to put it back together again and make sure it still works. (It does!)