On a final note, some brute force reflashing has revealed that the byte at offset 0x601B in the ROM seems to control which model is displayed at boot up and enable pulse/function/arb.
For example, my unit originally has 14, while AwArD_RzD's has 54. Changing it to 55 or 5D results in a BNC 625, while 5E or 5F results in a BNC 625A. If you have a unit that's stable and you just want to enable arb mode, I suggest only editing your own ROM and reflashing instead of flashing over the entire BNC625A ROM that's on here and losing your calibration data.
Tested with V3.3 and V3.5. By the way, if you ever have a bad flash over RS232, you can hold down the Remote key on boot up to enter boot loader code download mode. Boot loader versions I've seen include B2.1 and B2.2.