Might be helpful to know the default value for the register you are changing. I don't know how to read them, but you can find them in a startup log.
For example, 7D register 6:
GuiLockTas:ff0700c8:82:01:8: SIO [6]:0x690
If the image goes bad, try dialing the default value blindly (for example, to set the above, select register 6, move the cursor like this: 00, then press the up key 9 times). I find it unlikely to require a display refresh if you are only changing one register; display refresh may be needed when changing more registers, and one of them puts the controller in some invalid configuration (and you don't know which one). But if you are only trying one register at a time - just keep scrolling until the image gets back.
From startup logs, 700D and 650D (they are identical regarding TFT SIO) don't seem to follow the same register/value pattern. Their high byte is:
- always 0 at the beginning of each sequence, and also every now and then in the middle, but never seen any adjacent zeros
- 1 most of the time, also on adjacent positions, for example:
DisplayMgr:ff128980:82:01: SIO [0]:0xd1
DisplayMgr:ff128980:82:01: SIO [1]:0x114
DisplayMgr:ff128980:82:01: SIO [2]:0x11d
DisplayMgr:ff128980:82:01: SIO [3]:0x123
DisplayMgr:ff128980:82:01: SIO [4]:0x144
DisplayMgr:ff128980:82:01: SIO [5]:0x153
DisplayMgr:ff128980:82:01: SIO [6]:0x19a
DisplayMgr:ff128980:82:01: SIO [7]:0xc7
DisplayMgr:ff128980:82:01: SIO [8]:0x100
DisplayMgr:ff128980:82:01: SIO [9]:0x153
DisplayMgr:ff128980:82:01: SIO [10]:0x153
...
- 0x2* in some special cases (such as changing brightness), but these use a different chip select (GPIO, -d debugmsg,io in qemu), so they are talking to a different device:
DisplayMgr:ff128ca0:82:03: CalcBrightness = 92(DEC)
DisplayMgr:ff128cb8:82:03: CommandBrightness = 0x265c
DisplayMgr:000c5cf0:00:00: *** register_interrupt(0x0, 0x84, 0xff13c07c, 0x5), from ff13c228
DisplayMgr:ff1288dc:82:01: SIO [0]:0x265c
DisplayMgr:000c5cf0:00:00: *** register_interrupt(0x0, 0x84, 0xff13c07c, 0x5), from ff13c228
DisplayMgr:ff1288dc:82:01: SIO [0]:0x2492
**INTERRUP:ff127cb8:82:01: WaitTimerCallBack 120
DisplayMgr:ff1288dc:82:01: SIO [0]:0x2030
Hypothesis: 0x00rr might be register address, 0x01vv might be value (and if there are more values, register may get auto-incremented). Our sequence 0x36, 0x140 might be interpreted as "set register 0x36 to value 0x40".
That means:
/* should have no effect, no matter how many times you call it */
tft_command((uint32_t[]) { rand() & 0xFF }, 1);
/* should set register "reg" to value "val" */
tft_command((uint32_t[]) { reg, 0x100 | val }, 2);
Can you check these two sequences?