@Brian is right. Only primary surface I/O ports can be used.
I suspect that the primary (pun intended?) reason for this is that the Mix Rack I/O port has a lower channel count than the GigaACE link itself. The Mix Rack internal GigACE port carries I/O to/from the surface including PAFL, analog and AES sockets, DX, and I/O ports. On an S class surface there can be two I/O ports and the total channel count is advertised as more than 300. On a secondary surface the GigACE link is limited to the capacity of the I/O port and so it is not possible to support all the surface I/O.
In reality the channel count is high enough that up to 84 channels on a secondary surface I/O port could work. The mapping between GigaACE port and surface I/O is at least partially published, and it is my suspicion that the surface is “dumb” in this regard and just passes the audio data to and from the GigaACE link without caring whether it is primary and secondary. But the firmware does not support patching it.
I do wonder what would happen if I made a show file without a secondary surface and routed stuff to the I/O port, say channel 49. If I then connected a secondary surface would that audio end up going to Port4 channel 1? I wouldn’t want to work that way but…