One of my Z9s arrived and I've been able to spend a little time with it working on overclock.
1) The control board is exactly the same as the Z9 mini (batch1, at least).
2) cgminer executable has been modified, how, I don't yet know.
3) Using the cgminer executable from the mini on the Z9 does initialize one of the chains, and I can then overclock that chain greater than 550Mhz, but does not fully bring the system up.
4) brute force swapping the control boards produces the same result as #3.
In the factory configuration, I think what they have done is modify the cgminer executable to simply not accept frequencies greater than 550, and if provided a frequency greater than 550, to simply default back to 500. I say this because when I start up the factory configuration at 575 Mhz by editing /config/cgminer.conf, the chains (asics) initialize at 500Mhz.
Since bitmain has not provided the changes they have made to cgminer back to the community, the only option here is to reverse engineer the Z9 cgminer and see my hypothesis is correct, and if it is, generate a small binary patch to remove that check.
I don't currently know ARM assembly, so that is going to take me a while, if ever... but I can at least disassemble it in IDA Pro and see if what I believe appears to be true.
Otherwise, 500 ("Balance") produces around 42kSol and 550 ("Turbo") produces north of 50kSol... it'll probably land on 50kSol on a long average.
-j
That's what I noticed too, any change made above 550 reverts to 500. I know because I got 525m to work but nothing over 550m so editing is there but it won't let it go above 550m