A while back, I acquired a slightly broken E7495A unit, where the spectrum analyzer and signal generator work fine independently, but 1-port insertion loss and return loss measurements aren't right. For example, when performing a sweep from 375 - 376 MHz with a 10dB attenuator + 50 ohm load connected to the source, I get a flat 0dB return loss. Since there's no schematic for this unit, I ended up opening the RF assembly, and reverse engineering out the relevant area of the board.
The source input comes in at J7, and is connected both up through the coupler to the output of the unit, and down through C towards the input path at A. The reflected signal comes back from the coupler at D through E, and again towards the input path at A. Using a SDR, I've verified that the sweep looks correct.
I've also measured both the output signal at C, and the reflected signal at E, and they both seem correct. Unfortunately, there's some aliasing/noise because 375 MHz is the lowest output frequency of the E7495A, but my DS1054Z scope is only rated for 100 MHz, and my passive RP2200 probes are 150 MHz, even with me using the ground spring.
Also, the SPDT switches on this path are switching between the two signals, approximately 72% reflected and 28% output at 130Hz (yellow CH1 at U121, blue CH2 at U9, pin V_CTL). The signal that is not being driven through U9 is switched into a 50 ohm termination.