REST services - exposing non-data "actions"

/device/reset or /system/reset are ok.

The REST "design pattern" does encourage you to NOT use any verbs.. You could do:

POST http://mydevice/system/state    
<stateType>RESET</stateType>

Related information:

• How to create REST URL’s without verbs?
• Threads tagged with restful-url

I don't think that's the case to use POST. The "RESET action" is a idempotent action (if you call it n times you will always get the same result), so IMHO you should use a PUT call instead POST (as POST is not idempotent).

Also, as you are Putting a resource, you can use

PUT http://system
<device>
  <status>RESET</status>
</device>

or

 PUT http://system/status/reset

But I think the first one is "more restful", since you are putting a resource, while the second one you just use the URL.