Prove one exchange first
Before scanning, open the transport and send one documented or conservative read. On RTU, establish the Unit ID separately. If the basic request times out, scanning more addresses only creates a larger pile of identical failures.
Bound the first pass
Choose the most likely address space and a range suggested by the manual, device class, or known configuration software. Use a quick block-based search before single-address exhaustive probing. Watch the displayed request count and estimated time.
Treat the result as a map of responses
Readable does not mean documented, stable, writable, or safe. Build a view from the discovered block, observe it under controlled changes, and name only values you can explain. Never infer that adjacent holding registers are safe to write because they were readable.