I bet there wasn't one. The undocumented instructions are just unintended side effects of how the hardware works, not a ploy to give some programming teams an advantage via secret knowledge ;)

Yeah, it was my understanding that the opcodes directly encoded what we would nowadays call microcode, that is, bits which selected which CPU component acted on which data[1], so these illegal instructions are just unused bit patterns that select various operations just by having those bits set, not something that was ever intended to be actually used. So it would make sense that they're not documented, since they're entirely incidental.

[1] https://www.youtube.com/watch?v=dXdoim96v5A

There is a story about how BIT sets bit 6 into the overflow flag, and this was documented on a piece of parchment paper in pencil!

http://www.6502.org/tutorials/vflag.html

Either way, every transistor in the processor has been broken down completely, and even recreated in a visual simulation:

http://visual6502.org/

The overflow flag and its intrinsics was quite a mystery for a while.

(Related fun fact: There is no such thing as a break flag, it just gets inserted, whenever the the status register is pushed to the stack by an instruction, i.e. by software, as opposed to a hardware interrupt. This is also, why it is commonly shown as 1, because this is the value it would show up with, if there was a PHP or BRK instruction at the given time, which is also: always. But this is really just a virtual state and there is no such flag in the CPU.)