It's been in this state for a couple of months; no idea what the issue is.
1. First cold boot (after battery out): usually everything fine. Sometimes starting directly into state 2 or 3, with low probability.
2. Second (warm) boot: almost everything working, except rear dial.
3. Third (warm) boot: DryOS fully booting, GUI on the screen, but camera locked up. No reaction to buttons or card/battery door. Of course, the defect was also present without card, after clearing all Canon settings etc.
Before writing the above message, I've disassembled it a few times, reassembled, but there were no signs of getting better. I could, however, isolate the defect to the rear dial PCB (the one with a black ring on it). If I started the camera without that PCB, it worked fine (no lockups). If I started the camera without the back cover, but just with that PCB attached, the defect was present. There were no signs of damage of that PCB. On that PCB there is a small IC,
7147 ACPZ, talking to the rest of the camera (guess: to the MPU) via SPI. Image annotated by Danieel.
At some point I've started to probe the UART to look for interesting messages. Usually, I turn the camera off from the card cover, as it's faster than from the power switch. With the debug wire attached, I found it easier to use the main switch. After a few reboots I've noticed it no longer locks up. It was working again - that's when I wrote the previous message to document the UART pins.
Reassembled everything, but after putting back the last screws... the problem occured again. Oops! I still had the debug connector accessible, so I've tried to power-cycle it and see if there's anything interesting on the UART pins. While the camera was locked up, I've noticed the MPU restarting itself (printing MON>>> and E1OFF in a loop). Normally, the first message is printed at startup and the last one at shutdown.
Pressed the power switch / mode dial assembly a bit harder, I think, and it's back to life. Will see for how long.
Also found some factory routine that appears to check or calibrate the rear scrollwheel. They didn't seem to help or hurt, except at some point I've got scrollwheel events without any user input (as if the sensitivity was too high). They were gone at next reboot.
Not yet sure whether it was the scrollwheel PCB, or the power switch, or something else. I'm not yet able to get diagnostic logs from the MPU.
Edit: after typing this, the defect is back. One update: from the "completely locked up" state, I can turn off the camera by applying some force on the power switch. Just actuating it normally keeps the camera powered on and locked up, i.e. no reaction at all.
Edit: alive again. Go figure...
