I played around a bit more with that M58846 tonight and I believe I figured out how to make it dump its ROM. Pin 20 (CnVSS says the data sheet) seems to be the test pin.
if you disconnect this pin, it will pulse every instruction cycle, and reading some of the older docs they have a 'T4' timing output pin. This appears to be T4.
When the pin is pulled low, the chip enters a test mode where D5 high causes what I believe is the program counter to be emitted on D1, 3, 4, 6, 7, 9, and 10. A 7 bit binary count appears here, incrementing once per instruction cycle. The output pulses high in time with T4 for a "1" and stays low for a 0.
Pulling pin 20 to half supply puts it into what appears to be a ROM dump mode. During the time when T4 is low, the chip appears to accept a program counter value on 11 of the D lines, and when T4 is high it outputs the data on D1 and 3-10. 9 data bits, just like the ROM width.