Nice to see you getting in on this as well Sprite
I've been looking at the MMU setup, and you're right. There are some important memory locations but none of them seem like framebuffer material. The only memory region that's marked as non-cacheable is 0x3C... which is later marked as a mirror for the 0x24... memory range. Which is just RAM.
On a different note, I managed to find the offset the 3050ABin0.bin is loaded at. 0x241606E0 (yeah, way to go for logical offsets). If you want to reverse engineer this, I suggest you just stick on the end of the main firmware in IDA, it uses a lot of the firmware's functionality.
Anyway, I've got some information as far as the memory map goes, and stuff like that. I'd love to post it on the wiki, but it doesn't seem to be online yet?