5D3: found 3 interesting ADTG registers by comparing 1080 24p vs 30p in
ADTG GUI.
24p 25p 30p 50p 60p
ADTG2[8179] = ADTG4[8197] 0x891 0x784 0x6CA 0x39c 0x33c
ADTG2[82F9] 0x8E2 0x7CF 0x71B 0x3e7 0x38D
Right now, if you remove the safety limits in FPS override, lock timer A at default value (440) and try to get 25 fps from 24 using only timer B, you will get a black screen. If you first copy the values of ADTG2[8179] and ADTG4[8197] from 30p, then FPS override will all the way to 31 (from 24 just as well as from 30, which is a small breakthrough). If you decrease this value a little more, FPS override will go to 32 (before, the max value on 5D3 was 31). If you decrease it even more, FPS override will not go beyond 32, but you will get a cropped image.
The second register has no obvious effects (I don't know what it does), but seems correlated to the first one.
With ADTG2[8179/8197] = 0x535 (from 0x6CA), I could keep timerA at 398, pushed timerB at 1490, and got 40.470 fps, in 1080p (at least printed on the screen, with LiveView still working).
Of course, trying to record that crashed right away

To research this, I recommend using ADTG GUI from the
iso-research branch, and use FPS override to slowdown LiveView. Make sure you understand the existing code (fps-engio.c) and read g3gg0's notes from
http://magiclantern.wikia.com/wiki/Register_Map and
http://magiclantern.wikia.com/wiki/VideoTimer .
Have fun and take care, don't fry your sensor!