So, first thing first. This talk is pretty much specific to the 135-chip S7 version. The earlier 154-chip batches, what with the taller string and fixed voltage, are already as good as they're going to be without a regulator inline of your power supply. But the 135-chip is a bucked string, meaning it's got that regulator built into the board.
It looks like the stock voltage setpoint for an S7 is about 10.3V, or in the 690mV-per-node setpoint. That's about right for 700MHz according to the BM1385 datasheet. A lower-clocked S7 might have a lower voltage setpoint. I just received an S7LN, which is built for 600MHz on two blades; I measured the setpoint at 10.16V or 677mV per node.
The setpoint voltage is fixed. There is no knob to turn to change this.
HOWEVER...
The regulator's voltage is set by a digital potentiometer - more specifically, a digital rheostat (MCP4017). Basically a variable resistor whose resistance is determined by feeding it a number through a serial line. The default value is right in the middle, which is why some "dead" S7 will start to 9.3V - because the value isn't getting updated, so it stays on the middle setting. What should happen is the value gets updated by a little microcontroller (PIC12F1572), which pushes out a fresh value from memory as soon as it kicks on.
That's why Bitmain wants you to power the controller on last (or at least one potential reason), is because the DPOT and PIC get power from the 3.3V wire on the 18-cable to the controller. The "off" value of the DPOT is maximum, so the thing starts to well under 9V; as soon as the circuits see that 3.3V coming in from the controller, the DPOT lights up to center and a short time (a number of milliseconds) later the PIC sends it the number Bitmain gave 'em. If that PIC is toasted, that's when you sit at 9.3V and your S7 is only good for about 450MHz.
At the end of the S7 board are two headers. One two-pin header, GND and tied to a pin on the PIC. One six-pin header, wired up just right for In-Circuit Serial Programming of the PIC. What this means is, with the right basic hardware you should be able to pull firmware off the PIC or update it with your own.
One pin of the PIC, which can be configured for serial data, is tied to the TX pin on the 18-cable. Whether this means it can receive serial data from the controller or not is up to conspiracy theorists to decide. Does Bitmain have a secret version of S7 controller firmware which can change the voltage and they're keeping it for themselves? Maybe. Who knows. For the purposes of the immediate discussion, this is moot.
The PIC12F1572 does not have I2C hardware. Which means the protocol and timings would have to be implemented in software. Since we are talking to only a single device so we don't have to handle collissions, and it responds fast so clock stretching is unnecessary, and since we're only writing so getting responses is unnecessary anyway, it should be pretty straightforward.
I have generated a chart, not of every possible voltage the DPOT can set (since a lot of the voltages are so close together) but of more than half of them. I found hex values corresponding to every 10mV per node from 770mV down to 580mV, which is probably enough granularity for most people.
So what I'm thinking of doing is seeing about writing a basic custom firmware for the PIC, which still unfortunately implements fixed voltage but which can be updated easily to any voltage you want. What I'd probably do is have a set of files, each one labeled with its final setpoint voltage. The PIC would be programmed to set the voltage about 5% high for about a minute, which will help with bootup, warmup and the like. Then it would drop down to the setpoint.
I'm going to be up to my eyeballs in Compac and PSU board manufacture for the next couple weeks, so if anyone already has experience with PICs (and with bit-banging I2C) I'd certainly be interested in sharing what I know and some guinea pig hardware. Otherwise it'll be a hit-or-miss project for me, that probably shouldn't take more than a day or two except it'll be in odd hours between things. That, and I've never programmed PIC and I haven't done any microcontroller coding in about six years.
Guts of the thing - you can see my PICKit that I used to pull firmware and which I'd use to update with new once I can. Also the Bus Pirate currently attached in place of the PIC and feeding values to the DPOT directly.
This setup is currently set at 9.14V (610mV per node) and running at 450MHz stable. You'll probably complain that the error rate is way high. But of the 852 errors noted, 848 of them were from the first 3 minutes while it was warming up and I was still jacking around with the voltage.
If anyone's interested in donating toward this project, 1CoLDs7XNi8ehyFnGWicUhgBGb7Kw42Ugi
More of a bugger is that now I just don't feeling like going 20 miles to bring it all back up. That can wait til the morning I... 
I have a b5 that does almost as well. Wonder what they would do with a tad more Vcore done by raising the PSU voltage a tad? 