Got the data figured out. Just like the datasheet says too.
The datasheet makes it a bit confusing with the use of "TX" and "RX" for the two sides of the PLL (should be called side A and side B or something else). This radio only uses the "TX" side of this PLL for both TX and RX by clocking in the offset freq divider data each time the key is pressed or released. I will break this down for nayone that wants to do a channel mod (with a micro).
When the radio is powered, the channel is changed, or the PTT button is pressed/released, two data sequences are sent to the PLL with a 2ms delay between them (although I don't think that delay is critical). The first burst represents the reference divider data and the second burst represents the VCO divider data. With the radio on ch1, lets look at that.
The first burst is the reference divider (blue=clock, red=data).
Here, the leftmost 14 bits are the divider data and the remaining 10 are control data (that last bit on the end signifying its for the reference divider). The first 14 bits are binary representing hex chunks clocked in backwards, so 0000 0000 0001 00XX XXXX XXXX translates to 00 1000 0000 0000, which in hex is 0800, which in decimal is 2048. 10.24Mz/2048=5kHz. The PLL phase detector uses 5kHz. This does not change with TX/RX or channel.
Next is the VCO divider data. Looking at TX first. When the key is pressed, the second burst looks like this:
With the VCO divider data, the first 16 bits are taken. 1000 1000 1011 0000 XXXX XXXX, which written the other way around is 0000 1101 0001 0001, which is 11D0 in HEX, which is 3345 in DEC. 5kHz * 3345 = 16.725MHz. When that is mixed (added) with 10.24MHz, the output at 26.965MHz is obtained.
Looking at the burst going back into RX, we get this:
Now the VCO divider is getting 0110 1101 0011 0000 XXXX XXXX, and converting that to HEX we get 0CB6, which in DEC is 3254. 5kHz * 3254 = 16.27MHz, and that, when added to 10.24MHz is 26.51MHz. 26.965 - 26.510 = 455kHz for filtering and detection.
Now you know what to do if you want to arduino extra channels into the radio. Simply interrupt the clock, data and enable signals with your own data with the RX offset triggered on the PTT button. Its edge triggered, so clock frequency is not important. Could probably do it with a set of switches like on Halt and Catch Fire lol (I misremembered scene, just watched it, they manually read a memory chip, they didn't write to one with physical button switches like I thought. Good show though.).
Looks like the days of locked-down PLL's are over, this thing is wide open and capable of more than the rest of the radio could ever imagine