Good news, scisci found R36 being the right one.
Solder a 100 ohm resistor from the R36 pin near to the CPU to 3,3V.
R35 near to the memory should be 3,3V.
Check if connected to JTAG conn Pin 1 or 2.
With that patch applied you should get some message like:
JTAG-IDCODE: 0x00526fa1 - OK
Bypass-test: 0xaaab5554 - OK
Don't forget connection 1 - 17 on JTAG connector. It is needed to put the CPU into "Debug Mode" what actually halts it like on a breakpoint.
We found that this could be required after power up. For scisci it did not work when done before powering the NAS.
So maybe try to connect Pin 17 to Pin 1 (3,3V) after powering the NAS.
working:
Cable type x detected.
Device is in debug-mode - OK
CPU-ID: 0x003316 - OK
not working:
Cable type x detected.
Error: Device is NOT in debug-mode.
There is an entry
Bootloader - program Flash through JTAG at our wiki as well.
Good luck
HWguru