I've done a bunch more work on identifying how to edit Fizmo patches via MIDI. I've got the NRPNs worked out for about half of the sound parameters, including some of the ones not accessible from the panel. I'll post an update in a few days with all of the ones I've managed to identify. The internal architecture turns out to have some similarities to the Ensoniq MR series. The envelopes are six-segment types. You can set time and ending level for segments 1-4, level for segment 5 (which is sustain) and time for segment 6 (which is of course release). The filter is actually a lot more complex than the simple LPF that the panel allows you to access. There are a bunch of modulation routings that aren't accessible from the panel, nor does the manual even hint at them.
And some of these parameters, once set via MIDI access, aren't even reinitializable from the panel. For instance, the filter is actually two filters in series, and the four elements (poles) can be arranged in different combinations. There is a "link" parameter that ties the filter 2 settings to filter 1, but if it's off in a given patch, you can't turn it on from the panel, and you can't do anything that causes the filter 2 settings to change. I found this out when I was experimenting with NRPNs, and I managed to accidentally switch the link off, and all of a sudden I had a modulation on the filter that I couldn't get rid of. The modulation was on filter 2, and the panel controls only access filter 1. The same sort of thing can happen if you use a factory patch as a starting point for something.
Several things that appear to be simple on/off parameters from the panel are actually variable. One example is the envelope velocity scaling. There are actually two parameters associated with it. One is the active value; the other is a "save" location. The active value determines how much velocity modifies the attack time (actually all of the segment 1-4 times) of the given envelope. When you press the button on the panel to turn velocity off, it sets this parameter to 0. When you turn it back on, it actually sets the active value to the save value, which is not necessarily the maximum value. If you only set the active value via MIDI, then turn velocity off and back on at the panel, it will return to the save value, not the active value that was set. To make a change "stick", you have to set both the active and save values.
Patches actually do have names on the Fizmo. You can't see them from the panel (why oh why didn't they include a real display on the Fizmo?), but you can see and set them in Sounddiver. Oddly, the implementation makes every individual character in the name its own parameter. So, in Sounddiver, clicking in the patch name field and typing a single character results in a sysex exchange with the synth. A bunch of data flying back and forth to change one character. Individual sounds have names too, independent of the patch name. (If you read the Fizmo manual carefully, you will see that by playing games with MIDI Bank Switch and program changes, you can yank individual sounds from a stored patch into the active area, without actually changing the current patch.) Waveforms have names in Sounddiver too, although I'm not sure if it is actually retrieving these from the synth, or if it just has these hard coded.
Parameters are accessible via both NRPN and sysex. I got a tip from the Vintagesynth forum to look at the MR series sysex documentation for some tips. It turns out that the sysex that edits a single parameter is similar. It uses parameter numbers which are mostly the same as the ones the MR uses for its "sound" block of parameters. (The Fizmo, unlike the MR, doesn't group sounds into performances. Some of the things that are performance parameters on the MR are system parameters on the Fizmo. I haven't explored that yet.) Unfortunately, these numbers aren't all the same as the NRPN parameter numbers, but I'm gradually getting all that sorted. One odd thing I've noticed: Ensoniq, like most other manufacturers, transmits "large" numeric parameters (more than one byte) by spreading 32 bits of data over five bytes, owing to not being able to use the high bit in each byte on account of the way the MIDI protocol works. However, it appears that the Fizmo shifts most parameter values three bits to the left prior to encoding them for sysex transmission, and it expects to receive them the same way.
The bulk patch transfer sysexes bear no resemblence to the documented MR sequences as near as I can tell. In fact, the paranoid in me insists that Ensoniq deliberately tried to obscure the data. The MR documentation lays out a nice data structure format which includes, among other things, four-character ASCII sequences that identify the type of each block. In the Fizmo patch dumps, I don't see these. In fact, I don't see any recognizable ASCII strings at all: no patch names or anything. I did some experiments last night, changing one character in the patch name, dumping it, and comparing the MIDI dumps. The characters are there, but they are all shifted at weird offsets across bytes. Why? It certainly makes it harder to make any sense of a MIDI dump. Perhaps they wanted to allow for eight-bit ISO Latin-1 characters, or even Unicode, and so they worked out some means of packing the characters across bytes. As for the other parameters, I have no clue what order they are in, and a few experiments indicate that the MR documentation isn't going to be any help. I'll have to isolate them all, one at a time.
I haven't really gotten into the insert effect stuff yet. And then there's the arpeggiator, where the MR has no analagous feature. Much work to do yet.