The full datasheet and bcm97405 development board schematics can be found on web.
It can be configured for three different modes via stapping resistors.
In normal mode output from TDO is always 0.
In jtag mode you can read IDCODE, but nothing else...which leads me to believe TDI is disabled.
In ejtag mode output from TDI is always 1.
YMMV, its possible the manufacturer of your device did not disable the debug module, or blow any OTP fuses.