[Nexus 7 (2013) Q&A] .kaputnik.:
You're absolutely right, had no idea about QHSUSB_DLOAD mode. It works, there's hope, the hardware might be okay after all! Odd though, imagined the bootloader USB code was quite low level and standalone too, but maybe it shares libs with the rest of the system or something?

The connection details from USBTreeview, if it's of any use. Looks just fine to me at least, P/C 28 is of course just the missing driver:

=========================== USB Port1 ===========================

Connection Status : 0x01 (Device is connected)
Port Chain : 1-1-1
Properties : 0x01
IsUserConnectable : yes
PortIsDebugCapable : no
PortHasMultiCompanions : no
PortConnectorIsTypeC : no

======================== USB Device ========================

DriverKeyName : ERROR_FILE_NOT_FOUND

+++++++++++++++++ Device Information ++++++++++++++++++
Device Description : QHSUSB_DLOAD
Device ID : USB\VID_05C6&PID_9008\6&3A6A7FD9&0&1
Hardware IDs : USB\VID_05C6&PID_9008&REV_0000 USB\VID_05C6&PID_9008
Driver KeyName : -
Legacy BusType : PNPBus
Enumerator : USB
Location Info : Port_#0001.Hub_#0004
Location IDs : PCIROOT(0)#PCI(1A00)#USBROOT(0)#USB(1)#USB(1), ACPI(_SB_)#ACPI(PCI0)#ACPI(USBE)#ACPI(RHUB)#ACPI(PRT1)#USB(1)
Container ID : {acbd03bb-d39a-11e9-844a-f46d044eca1c}
Manufacturer Info : -
Capabilities : 0x04 (Removable)
Status : 0x01806400 (DN_HAS_PROBLEM, DN_DISABLEABLE, DN_REMOVABLE, DN_NT_ENUMERATOR, DN_NT_DRIVER)
Problem Code : 28 (CM_PROB_FAILED_INSTALL)
Power State : D3 (supported: D0, D2, D3, wake from D0, wake from D2)

+++++++++++++++++ Registry USB Flags +++++++++++++++++
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\usbflags\05C690080000
osvc : REG_BINARY 00 00
SkipContainerIdQuery : REG_BINARY 01 00 00 00

---------------- Connection Information ---------------
Connection Index : 0x01 (1)
Connection Status : 0x01 (DeviceConnected)
Current Config Value : 0x00
Device Address : 0x02 (2)
Is Hub : 0x00 (no)
Device Bus Speed : 0x02 (High-Speed)
Number Of Open Pipes : 0x00 (0 pipes to data endpoints)
Data (HexDump) : 01 00 00 00 12 01 00 02 00 00 00 40 C6 05 08 90 ...........@....
00 00 01 02 00 01 00 02 00 02 00 00 00 00 00 01 ................
00 00 00 ...

--------------- Connection Information V2 -------------
Connection Index : 0x01 (1)
Length : 0x10 (16 bytes)
SupportedUsbProtocols : 0x03
Usb110 : 1 (yes)
Usb200 : 1 (yes)
Usb300 : 0 (no)
ReservedMBZ : 0x00
Flags : 0x00
DevIsOpAtSsOrHigher : 0 (Is not operating at SuperSpeed or higher)
DevIsSsCapOrHigher : 0 (Is not SuperSpeed capable or higher)
DevIsOpAtSsPlusOrHigher : 0 (Is not operating at SuperSpeedPlus or higher)
DevIsSsPlusCapOrHigher : 0 (Is not SuperSpeedPlus capable or higher)
ReservedMBZ : 0x00
Data (HexDump) : 01 00 00 00 10 00 00 00 03 00 00 00 00 00 00 00 ................

---------------------- Device Descriptor ----------------------
bLength : 0x12 (18 bytes)
bDescriptorType : 0x01 (Device Descriptor)
bcdUSB : 0x200 (USB Version 2.00)
bDeviceClass : 0x00 (defined by the interface descriptors)
bDeviceSubClass : 0x00
bDeviceProtocol : 0x00
bMaxPacketSize0 : 0x40 (64 bytes)
idVendor : 0x05C6 (Qualcomm, Inc)
idProduct : 0x9008
bcdDevice : 0x0000
iManufacturer : 0x01 (String Descriptor 1)
iProduct : 0x02 (String Descriptor 2)
iSerialNumber : 0x00 (No String Descriptor)
bNumConfigurations : 0x01 (1 Configuration)
Data (HexDump) : 12 01 00 02 00 00 00 40 C6 05 08 90 00 00 01 02 .......@........
00 01 ..

------------------ Configuration Descriptor -------------------
bLength : 0x09 (9 bytes)
bDescriptorType : 0x02 (Configuration Descriptor)
wTotalLength : 0x0020 (32 bytes)
bNumInterfaces : 0x01 (1 Interface)
bConfigurationValue : 0x01 (Configuration 1)
iConfiguration : 0x00 (No String Descriptor)
bmAttributes : 0x80
D7: Reserved, set 1 : 0x01
D6: Self Powered : 0x00 (no)
D5: Remote Wakeup : 0x00 (no)
D4..0: Reserved, set 0 : 0x00
MaxPower : 0x01 (2 mA)
Data (HexDump) : 09 02 20 00 01 01 00 80 01 09 04 00 00 02 FF FF .. .............
FF 00 07 05 81 02 00 02 00 07 05 01 02 00 02 00 ................

---------------- Interface Descriptor -----------------
bLength : 0x09 (9 bytes)
bDescriptorType : 0x04 (Interface Descriptor)
bInterfaceNumber : 0x00
bAlternateSetting : 0x00
bNumEndpoints : 0x02 (2 Endpoints)
bInterfaceClass : 0xFF (Vendor Specific)
bInterfaceSubClass : 0xFF
bInterfaceProtocol : 0xFF
iInterface : 0x00 (No String Descriptor)
Data (HexDump) : 09 04 00 00 02 FF FF FF 00 .........

----------------- Endpoint Descriptor -----------------
bLength : 0x07 (7 bytes)
bDescriptorType : 0x05 (Endpoint Descriptor)
bEndpointAddress : 0x81 (Direction=IN EndpointID=1)
bmAttributes : 0x02 (TransferType=Bulk)
wMaxPacketSize : 0x0200 (max 512 bytes)
bInterval : 0x00 (never NAKs)
Data (HexDump) : 07 05 81 02 00 02 00 .......

----------------- Endpoint Descriptor -----------------
bLength : 0x07 (7 bytes)
bDescriptorType : 0x05 (Endpoint Descriptor)
bEndpointAddress : 0x01 (Direction=OUT EndpointID=1)
bmAttributes : 0x02 (TransferType=Bulk)
wMaxPacketSize : 0x0200 (max 512 bytes)
bInterval : 0x00 (never NAKs)
Data (HexDump) : 07 05 01 02 00 02 00 .......

----------------- Device Qualifier Descriptor -----------------
Error : ERROR_GEN_FAILURE

-------------------- String Descriptors -------------------
String descriptors are not available (because the device has problem code CM_PROB_FAILED_INSTALL)

Didn't think any measurements were needed now when I got the QHSUSB_DLOAD mode working, but did them anyways since you asked me to. Now I'm really confused. Strangely enough, some of my measurements are very different from yours, and meter polarity seems to matter here. Perhaps my meter uses a higher voltage than yours, higher than the ESD suppressor forward voltage, or something? Still hard to explain the differences with Android running though...

Plugged in and measured through the USB Micro cable I cut and stripped before:

Unit off, charger disconnected, battery still connected:

GND-5V: 7.8kOhm (polarity independent)

GND-D-: 18.5 kOhm (-probe on GND) 4.1 kOhm (+probe on GND)

GND-D+: >40 MOhm (-probe on GND) 9.3 MOhm (+probe on GND)

D+-D-: 9.3 MOhm (+probe on D-), >40MOhm (-probe on D-)

Unit on, Android running:

GND-5V: 5.2VDC

GND-D1: 0V

GND-D2: 0.31VDC

Redid the measurements twice with the same results.

As you probably have noticed, I'm very much a novice in this field. Got no idea what the voltages and resistances are supposed to be. Is it possible it could be something with the charging circuitry? Another thought, there's [only?] 209 kOhm between the mode select pin and ground. Is it perhaps possible that my device is stuck in OTG mode?

Ah, it's some kind of zener barrier. Thought it might be for signal processing only first, but hard to determine by measurements when you're not sure it's not broken :)

Once again, thanks a lot for your time and effort in helping me out with this. I really appreciate it. Even if we don't find a solution, it's at least very interesting and educative :)