Cool, thanks for the addresses, I added it to my spreadsheet of the full default RAM address listing (I'll upload it soon).
Maybe that double space when programming the serial number by GPIB has something to do with the extra byte? We'll have to sniff it while programming via GPIB to be sure what's up.
Out of interest, here is the default values for the serial number. Not sure how much this tells us though:
I'm still working on reading from the Bus Pirate with a batch script (not having much luck yet).... I might have to leverage Plink (command line version of Putty), or learn Python if I can't get it working natively in a batch script.