[HTC Wildfire S] no.human.being:
You know the "PG76DIAG.nbh" file right? (Again the hint: Don't put it on your SD card unless you know what you're doing! It will execute on next boot and wipe all data! :D )

When you have it on your SD card, a diagnostic utility will start immediately, wipe all data, recalibrate the touch screen, offer you an option to "Clean S58", etc.

The first 0x100 (256) bytes of the DIAG file look random and are probably the RSA signature (256 byte = 2048 bit, which is a common RSA key size).

Then comes a header of size 0x200 (512) bytes, where you find the "string" "HTCIMAGE" with each character stored in the least significant 8 bits of a little-endian 32-bit word (?!), the board type ("PG76*****" @0x120), the CID ("11111111" @0x2c0), the software version ("0.13.0.0" @ 0x2e0) and some other values that I don't quite understand (0x308c1b02 @0x1bc, 0x00000200 @0x1c0, 0x000b066c @0x240, "Generic" @0x2f0 - perhaps addresses, offsets, length fields, who knows?).

After this there appears to be a complete HBOOT image. It's HBOOT-0.81.2000, an ENG HBOOT. It starts at offset 0x300, where you'll find the famous 0xea000012 unconditional branch instruction that all HBOOTs begin with. It seems to be an HBOOT for the HTC Legend, as you'll find the string "LEGEIMG.zip" at offset 0xae9e0 in the DIAG file.

Now what comes to my mind:

1. Firmware for Legend and Marvel are obviously very similar (identical?) since they use the same diagnostic utility. Firmware is probably identical for all devices that use the MSM7227 SoC, which means you should be able to use bootloaders, Radios, etc. for any of these devices provided you're willing to flash an entire image, since it will probably modify the partitioning.

2. This diagnostic utility is obviously a bootloader (for whatever reason) and it's loaded by another bootloader. Remember the "PG76DIAG.nbh" file is read from your SD card and executed by the HBOOT on your phone. Obviously, the bootloader in the DIAG file is designed to be "chainloaded" and not "fall back". So the fallback is most likely a "feature" of HBOOT (the chainloaded one) itself and not of a "higher power" since the DIAG file HBOOT doesn't fall back.

3. Remember when you run DIAG it clears your memory straight away, then recalibrates touchscreen and so on. It's a very "automated" process that doesn't offer you a lot of choice. Now we know there's a complete bootloader in DIAG, why doesn't it display its menu, where it shows all the software versions and from where you can boot into ROM, Recovery, etc.? It appears that the DIAG utility by itself doesn't make any use of the bootloader. Why didn't they just write the diagnostic code (that stuff that runs through and clears data and recalibrates touchscreen, etc.) and put it in a "boot image"? Why put a bootloader in front if all you do is execute a few kilobytes of diagnostic code and you already have a bootloader on the device?

4. Can we modify the code (yes, this will break the signature, but we can prefix it with the "chainloader" and it's designed to be loaded by another bootloader so it most likely won't "fall back" and then run it unsigned) so that it in fact operates as a "normal" (ENG) bootloader?

5. An ENG bootloader will never check signatures, right? Can we use this fact to put "our" (patched) HBOOT inside a "LEGEIMG.zip" (remember that the ENG HBOOT in the DIAG file is actually for the Legend so it will check for "LEGEIMG.zip", not for "PG76IMG.zip") and have it flashed? Will it flash to the right space or will we have to flash an entire Legend firmware image first because of the different partitioning? Will running the Legend firmware on the Marvel be of any disadvantage? Remember that the Legend uses the same SoC, but is significantly older and lower spec (384 MiB RAM vs. 512 MiB RAM, etc.) than the Marvel.