So I ended up taking the power sensor apart.
Here's my reverse engineering so far.
The detector is built with three sections,
1. RF section
Directly after the K-connector I see what I assume is a DC-block
After that I see what I think is dual diode detectors and 50Ohm termination, possibly positive/negative mounted.
After that is a mystery chip (see attached picture) which I think is a Maxim or Macom chip. Possibly this is a crosspoint switch. One of the control signals going to the RF section is switching 0 to 5V at low power levels (less than -30dB). I believe this could be to eliminate the detector bias?
2. DC amplification and signal conditioning, the signal chain is:
Two stages of amplification, differential, one for each diode and a gain selection. As the attached PCB top and bottom photo shows the layout is symmetrical for the two diodes.
2.1. is a TI TLC2202AI dual OPAmp (PCB Top)
2.2. is a Max 393 Quad SPST switch (PCB Bottom). Single 0/5V control signal from the Power meter. Two switches are used to change the gain between Unity and an amplification ratio.
2.3. is a Max 410 dual OpAmp (PCB Top)
There is also a 24AA64/24LC64 64k I2C eeprom for model and calibration coefficients, neat compared to older HP models I've used.
The bottom side holds a bunch of ESD protection diodes aswell.
3. 12-pin interface to cable
Pinout coming when I find my notes, but from the top of my head there's the following:
Ground
+-5V
Two control signals - Gain, Crosspoint switch?
I2C - SDA, SCL
Differential detection signal - makes sense for long cable lengths
It seems something is broken in the RF section, possibly one of the diodes in my detector is dead.
I see the output on the differential amplifiers chain react to RF signals, and when I inject negated DC signal with the same magnitude as the working side, the readout is very close to the correct RF amplitude.
Best regards