Hey ericlewis - this is cool! Can I ask how you figured it out?!
Doing this for my PO-33 was on my bucket list.
I thought I might have to resort to voltage glitching to get a firmware dump, which is currently beyond my skills.
Unfortunately I think only a few of the PO's support this transfer method, and I don't think the 33 is one of them. They were never meant to be updated at all, as I understand it.
I was able to get part way some years ago by demodulating the bitstream with gnuradio and then making small changes (like replacing one note with the next higher one) and noting the differences. So that is one possible, but probably too inefficient way.
I never got close to finishing or publishing anything. Awesome to see this released and I'll have to play with it!