I toyed with my Pixel Watch fastboot over lunch some more and so far I now have:
- a full ramdump from fastboot
- a sha1sum of the boot partitions, and of the first 0x200 bytes
- still no way to actually figure out the boot.img parameters (except maybe by bruteforce lol)