The specific thing I've found least documented, yet most important for the distinctive percussive attacks of the DX7, is a random variation of the pitch envelope for the first few milliseconds of the note. That's almost short enough it could be done in the firmware, but I believe it might be in the hardware. It's not present in the msfa source, but might have been recovered by later Dexed authors (I haven't carefully looked at their code).

If you get to the envelope hardware, you'll find it's just as clever as the exponential and sine generators. There's some info at [1], but it doesn't capture every single thing I found - there are cases where there is a slight amount of additional noise in the amplitude, I'm not sure whether intentional to give more character or an unintentional artifact. That's also missing from the msfa source.

[1]: https://github.com/google/music-synthesizer-for-android/blob...

ETA: Also see https://levien.com/dx7-envelope.html for a somewhat interactive JavaScript implementation of the envelope algorithm. This accurately emulates the envelope shape and quantization of the DX7 (ie it uses the same reduced number of bits to drive its state machine), but I do not claim it is bit-perfect.