FWIW, this thread mentions uncommenting the smfp entry in dll.conf. Did you do that?
It would be interesting to observe which port(s) the scanner device is listening on
nmap <IP address of scanner>
- There will be a mixture of ports due to the printer and in-built http server running, but at least one for the scanner