I would particularly like to highlight the work of Dataflow Forensics and their much more advanced work dissecting SPTM without the benefit of source code. I enthusiastically await their promised blog post about exclaves and hope they will answer many of the remaining questions, provide gory disassembly explanations, and correct all my mistakes and assumptions!
Yes, they're saying that there's some stuff they didn't cover, and they hope the Dataflow people will. But the first couple didn't really answer much so I'm not particularly hopeful.
