Here they are! Found them on the Win96 site.
Added an “extended frequencies” option, which seems to enable some sort of hidden test mode that allows all frequencies except cellular. Frequencies can be sent from Win96, or can be entered directly on the scanner’s keypad (including in SR6 – Limit Search).
Addendum: Some ranges still appear to be "blocked" by the scanner. Here are the ranges that seem to be "opened" with this feature:
17 - 25
54 - 108
225 - 406
512 - 550
764 - 806
960 - 1240