I added some traces and I see the values after plugging in the tuner, just after the call rtlsdr_set_i2c_repeater(dev, 1) in rtlsdr_open, are:

GPD = 0x06
GPOE = 0x19
GPO = 0x18

so in my understanding initially:
* GPIOs 1 and 2 are set to INPUT
* GPIOs 0, 3 and 4 are set to OUTPUT
* output GPIOs 3 and 4 are set to 1, GPIO 0 is set to 0

With the code before the GPIO fix (ba64a745) the call rtlsdr_set_gpio_output(dev, 5) read GPD and set its value to GPO while dropping the 5-th bit from the GPD value. So it assigs the value 6 to GPO. This sets all output GPIOs to 0: GPIOs 3 and 4 are dropped to 0. Then it sets GPOE to the previous value of GPOE plus the 5th bit, so it sets GPIO 5 to output and its output value is 0 because of the previous write.

I don't know where does the value 5 come from. Is it possible some other dongles have the tuner at GPIO 5? Or is it really supposed to be GPIO 4 and it worked with 5 by accident - by pulling GPIO 4 to 0 accidentally?

A friend of mine looked at the PCB of the dongle I'm using and he found out that GPIO 4 seems to be connected - via a transistor - to the TC0012. GPIO 5 didn't seem to be connected - at least not in an obvious way - to the tuner. I have to say this was just a quick look, so we could have missed things.

Also, as there's a transistor in between... could it be that GPIO 4 is not really tuner reset, but tuner power? But this would be rather philosophical point. Either way, from my tests, GPIO 4 has to be set to 0 for the tuner to be reachable.