This thread covers the required parameters for a Sub-Device.
http://www.rdmprotocol.org/forums/showthread.php?t=1034
To find the subdevices that exist, really all you can do is send a GET DEVICE_INFO (or other similar PID) to every sub-device starting with 1 and work your way up until you find all of the sub-devices that the responder reports. If the responder returns a NACK with NR_SUB_DEVICE_OUT_OF_RANGE, you can conclude that subdevice does not exist and move on to try the next one.
There's been some discussion of adding a PID that will retrieve a packed list of sub-devices in the future, but it doesn't exist yet.