Yeah, if you look at the block diagram in the F900BT/F90BT service manual posted on the Hacks/Mods forum, it looks like the AV board has an ASIC (uCOM) that the Navi controls via a UART to select amongst the various audio sources (Tuner, SD/USB, AV1, AV2, Bluetooth and voice, a.k.a. navigation commands), send commands to the IP Bus and other components (like the tuner?) and such. Once my test subject arrives this week and gets a lovely bench setup, I'm hoping to get some probing on some of the Tx/Rx and I2C lines to see what commands are getting shuffled about between the blocks in the diagrams. Once I've got some protocols documented I hope we can reverse-engineer our own drivers and cook our own image.
Once that's done there is always the potential for alternative OSes too, I know QNX already has a BSP for the Titan reference board they based the Navi unit off of.