=============== Received AVC Response ===============
opCode: Sub-Unit Info (0x31)
FCP Response Frame:
0C FF 31 07 28 48 FF FF
The 28 specifies a tuner subunit
The 48 specifies a panel subunit
So it looks like your 6200 does indeed have a panel subunit.
While the tuner subunit is there only for device matching, the panel subunit possibly does have some useful functionality with regards to FireWire driven channel changing.
There are two types of panel subunit implementations, direct mode, and indirect mode.
Direct mode is the more complex mode, where the target device (STB) can actually export a full, multi-page GUI control panel (with buttons, icons, sliders, etc.) to the controller (DTV), then the DTV sends "USER ACTION" commands to the STB when the user interacts with the various elements of the on-screen panel. It's possible, but unlikely that this device implements a direct-mode panel subunit. You can test to see if this devices supports a direct-mode panel subunit by hooking it to a Mits TV (with FireWire), and selecting it as the current device, and pushing the "Device Menu" on the Mits remote.
The other type of panel subunit, the indirect-mode, is a much simpler implementation. This mode supports only one AV/C command, the "PASS-THROUGH" command, that represents button press/release from a remote-control being "passed through" the FireWire cable to the target device.
In the latest AV/C panel specification (currently 1.21), new operation_ids were added for deterministic functionality. Previous versions of the spec had "channel up" and "channel down", but now we have the "tune" operation where you specify the exact channel to tune to (a much more useful method of handling this).
AVCBrowser can be used to send commands to the panel subunit. Without going in to great detail here, you could try:
where xx is the channel number from 0x00 to 0xFF (in hex).
Note that AV/C targets can be fussy with regards to the exact values of operands in an AV/C command (vs. what it is expecting), so if that doesn't work, the device may reject the command, yet still support the tune functionality if a few of the bytes are changed (for example, the reserved bytes FFFF, may need to be 0000). There are other changes that may need to be made to other bytes as well. Since I don't have one of these cool boxes, I cannot experiment for myself, and it would probably require that you have access to the 1394TA spec to know what to tweak from there.