I've mapped the JTAG pinouts from the traces of J3 on this unit as follows:
May I ask how did you find these? I am doing the same on ADSL2MUE and surprisingly JP1 looks exactly like the EJTAG interface you describe (GND and Vcc lines do match). But I am not brave enough to connect anything that might break it down. Any advice?
BTW, on your bootloader login request, did you manage to get into it? From what I've read bootloader environment is stored with nvram config instead of being coded into the software itself so having access to read the flash partition should lead you to fin the boot login and password, don't you think? ADSL2MUE has version 1.2 too and ESC key works like a charm.
Regards
Jose Angel