The dpy IOT was one that seems to have been hacked multiple times back in the real PDP-1 days. After running into various issues with various programs, etc., I finally wrote down what I think the variants are. Some of these were done on just one or two machines as far as I know. Just for fun, here's the list. If I'm wrong about something, let me know.
Some machines had a variation where the intensity could be set using the xx03xx bits. The valid values for the -1 seem to have been 0,1,2,3. But, did it actually use the xx07xx bits? Not sure. It seems the Type 30's could support 7 intensity levels, but also not sure this was done for the -1 variants.
Spacewar uses it.
Some had a variant where the display origin could be shifted, setting the x origin to the left edge and/or the y origin to the top edge using the xx30x bits. This one was clever and simple, it just complements the sign bit of the display address(es) if set.
Snowflake uses it.
The Type 33 symbol generator added the sdb variant, invisibly move display point using the value xx20xx, which conflicts with the origin-shifting.
Given that the symbol generator was an official product, I'd say this one takes priority over origin-shifting.
The aperture-setting variant, added to support the pseudo-lightpen, uses the value xx34xx.
This theoretically could conflict with some random variation, but I haven't found any conflicts. My comment on this is that I added it in the same spirit as the ones above, the -1 was hacked in many different ways by many different users.
Bill