Ok, finally took my rigol apart, warranty sticker removes very easily using the same method people use on xbox.
Measured some signals, there is a small DAC chip with "D5G" marking. Looks like its constantly fed by CPU/FPGA, so the output is steps of different height.
DAC output feeds two 4051 multiplexors, which are being switched by 8khz counter.
I am wondering if they use this approach to generate offset voltages, trigger levels etc with only 1 DAC?