But if my TV is doing this, then by definition it's not acting as an exit node so how do I test it?
Or if this theoretical implementation by a manufacturer is using a custom protocol/frequency (very unlikely for a variety of reasons), you'd begin by probing with an SDR.