Sure; if my timing works correctly, I can send any opcode. But we'd have to figure out how to detect the results. The S outputs are tied up in test mode, but I guess we could conditionally set/clear segments as indicators.

I think you probably saw Paul Robson's blog: The posts have some of the ideas that he got from the datasheets and patent 4,504,062. The links are dead, but I had downloaded the files if you think they would be useful.