# SegaSonic The Hedgehog (V60 program): the code no control script runs, and why
#
# Coverage: 43042 of the 47575 instructions the static analysis finds (tools/disassemble.py with
# symbols.txt, no traces) ran in at least one of the 98 scenarios of tests/controls (the union of
# build/scenarios/*/executed.txt, ROM mirrors folded, as tools/check_scenarios.py compares them).
# 3908 of the other 4533 are the code nothing in the program calls, which the analysis reaches only
# through symbols.txt's func lines for it ("unused: ..."; most of it in the unused code section): dead
# by definition, and symbols.txt says what each piece is. The other 625 are listed here, one line per
# piece, by address:
#     START-END  function  [category] evidence
# START-END runs from the first byte of the first instruction to the last byte of the last one;
# function is the label (symbols.txt name) the piece belongs to. Categories:
#   H  Needs hardware the board model does not have, or a hardware fault: 114 instructions
#   T  Runs, but the reference trace cannot record it: 1 instruction
#   D  Dead: nothing in the program leads there, or its condition can never hold: 438 instructions
#   N  Not reached: a rare situation the scenarios do not produce (not shown impossible): 72 instructions
# Addresses, values and object/player fields are hexadecimal, as in the listing; "player 72" is field
# 72 of the player block (208400 + 200 per player), "object 30" field 30 of an object.
#
# Dead in the game but run by poked scenarios (so not listed below; each script's header has the
# evidence that the game never gets there and what every poke stands for): unspawned_object_types
# (object types 04, 08, 09, 11, 15, 1B, 1D), dead_game_modes and game_over_cabinets (game modes 5, 6, 9,
# B, E, F, Stage Select's trackball stepping, the grey screen, continue_to_next_stage_slot,
# per_player_view_mode), dead_states_and_rare_waits (player states 3, 10-12, 1A, 1B, 2D),
# contact_kinds_poked and contact_kinds_players_poked (touch kinds no object has), animation_variants_poked
# (backwards and flipped animations), stage_slot_pokes (stage slots 01, 02, 12), stage_03_end_sequence
# and stage_03_skip_finale (stage 3 past its finale), walls (wall kinds 00 and 14), roller_ram (the
# spiked roller's ram state), test_mode_bitmap_and_backup (4 bpp bitmap, clipped lines, the hidden
# SMALL/LARGE setting), and smaller pieces in other scripts, named in their headers.

003005-003007  player_animate  [D] state 3's entry of the table at 002FFC: nothing sets state 3, and a player in state 3 returns at once in player_update's first switch (player_state_inactive 003593: rsr) before player_animate
00300B-00301F  player_animate  [N] entries of states 5-B (no animation): player_animate is entered (002FEB at the end of player_move, 004EE5, 006272) only with states that have an animation entry (0, 1, 2, 4, C, 13, 14, 17 in every scenario): player_move goes back to the first switch (2D33) for the states in player_state_stops_move (114074), for E/22, for the floor-type states (002F61) and edge states 5-9 (002F79), and player_steer rewrites the state (00BB64); only a rare combination would end player_move in a state without an animation (a contact setting state 1F while player_steer is skipped, or a scene exit that restores a previous state and jumps into player_move: 006331, 00636D, 006396, ...), and none was produced
003023-003034  player_animate  [N] entries of states D-12 (no animation): player_animate is entered (002FEB at the end of player_move, 004EE5, 006272) only with states that have an animation entry (0, 1, 2, 4, C, 13, 14, 17 in every scenario): player_move goes back to the first switch (2D33) for the states in player_state_stops_move (114074), for E/22, for the floor-type states (002F61) and edge states 5-9 (002F79), and player_steer rewrites the state (00BB64); only a rare combination would end player_move in a state without an animation (a contact setting state 1F while player_steer is skipped, or a scene exit that restores a previous state and jumps into player_move: 006331, 00636D, 006396, ...), and none was produced
00303B-003040  player_animate  [N] entries of states 15-16 (no animation): player_animate is entered (002FEB at the end of player_move, 004EE5, 006272) only with states that have an animation entry (0, 1, 2, 4, C, 13, 14, 17 in every scenario): player_move goes back to the first switch (2D33) for the states in player_state_stops_move (114074), for E/22, for the floor-type states (002F61) and edge states 5-9 (002F79), and player_steer rewrites the state (00BB64); only a rare combination would end player_move in a state without an animation (a contact setting state 1F while player_steer is skipped, or a scene exit that restores a previous state and jumps into player_move: 006331, 00636D, 006396, ...), and none was produced
003044-0030AC  player_animate  [N] entries of states 18-39 and their common br 2D33 (0030AA): player_animate is entered (002FEB at the end of player_move, 004EE5, 006272) only with states that have an animation entry (0, 1, 2, 4, C, 13, 14, 17 in every scenario): player_move goes back to the first switch (2D33) for the states in player_state_stops_move (114074), for E/22, for the floor-type states (002F61) and edge states 5-9 (002F79), and player_steer rewrites the state (00BB64); only a rare combination would end player_move in a state without an animation (a contact setting state 1F while player_steer is skipped, or a scene exit that restores a previous state and jumps into player_move: 006331, 00636D, 006396, ...), and none was produced
003612-003614  player_animate_jumping  [D] the R0 = 0 case after "mov.h #4, R0" (00360B): R0 is a constant 4 (attack_power is always 4)
00368A-00368C  player_animate_jumping  [D] needs attack_power (player 72) < 1 at 003683, but every path from 003594 to it stores 4 there (003620/003630, R0 = 4 from 00360B); the only other write (0035C0, 0) comes earlier on the same path
0036D2-0036D4  player_animate_jumping  [D] needs attack_power (player 72) other than 4 at 0036CB: it is always 4 there (see 00368A)
003800-003805  player_animate_jumping_land  [N] a jump whose animation ends with floor_block -1 without check_player_floor_edge turning it into state 7 first (00B4BA): possible only on platforms; not produced
003DD9-003DEC  player_falling_off_edge_check_sinking  [D] needs object flag 11 (field 30) in state 6: the flag is set only at 00EA6C, which forces state 7 at the same time (cleared at 002A27, 003EA8, 00424C, 00B5A1, 00EC16); state 6 runs no contact check and is entered only from 003A81 or 0088CA with ledge side 4
003E5A-003E73  player_state_over_edge  [D] state 7 step 0 on floor type 1: step 0 is entered only from 00B48E (a zone of touch kind 1D, on stage A only: 089CA8), and no floor block of stage A has floor type 1 (its blocks give 0, 9, A, B)
003E8E-003E92  player_over_edge_depth_minus_10  [D] the floor type 1 case of state 7 step 0 (see 003E5A)
0042C4-0042E2  player_over_edge_back_on_floor  [N] the pull-back of state 7 (steps 4/5) while the player is more than 50 off screen (then player_respawn 294A, or state 16 at vitality 0): needs a multi-player game where a player hangs off screen and pulls back; not produced
004758-00475A  player_state_climbing  [D] substep 1's entry of the state A table (004755): state A is entered with substep 0 or 3 (00471E/002F56, 00D936/00D9EC), and substep 0 falls into substep 1's code (0047AC, 0047AF), which sets substep 2 or 3 in the same frame, so the table never sees substep 1
005AE7-005AEA  player_hurt_recover  [D] hurt step 7's branch for an electric fence post whose field 95 is 0 or 1: touch kind E exists only on the fence posts (0138F7), and their records (100476, 100484, 100492) give field 95 = 2, 3, 3 (copied at 01397E)
005AEF-005B10  player_hurt_recover  [D] the same fence post branch as 005AE7 (field 95 = 0 or 1)
0062A3-0062AB  player_state_entering_stage  [D] entries for stages 0, 1 and 2: stage_player_entries (1140AE) is 0 for them, so 00CFEA never sets state 2A there; stages 1, 2 and 12 are never entered (stage_order 002639 never gives them, Stage Select slots 01/02 come back as 07); on stage 0 check_player_reached_goal forces state 18 every frame (00D1DE); stage 11 runs in game mode 18, where check_scene_states forces state 2B every frame (00D6AF) before the state switch
0062D6-0062DB  player_state_entering_stage  [D] entries for stages 11 and 12: stage_player_entries (1140AE) is 0 for them, so 00CFEA never sets state 2A there; stages 1, 2 and 12 are never entered (stage_order 002639 never gives them, Stage Select slots 01/02 come back as 07); on stage 0 check_player_reached_goal forces state 18 every frame (00D1DE); stage 11 runs in game mode 18, where check_scene_states forces state 2B every frame (00D6AF) before the state switch
0063AD-0063B2  player_state_stage_exit  [D] entries for stages 1 and 2 of the state 21 table: those stages are never entered (stage_order 002639 never gives them; Stage Select slots 01/02 come back as 07)
0063E0-0063E2  player_state_stage_exit  [D] entry for stage 12 of the state 21 table: stage 12 is never entered (not in stage_order 002639, beyond Stage Select's 00-11)
0064DC-0064DE  player_state_tumbling  [N] substep 1 of state 20: the same hazard hitting again while in it (00E919 keeps the substep); not produced
006524-00652C  player_state_tumbling  [N] substep 1 of state 20 (see 0064DC); not produced
0065D5-0065D7  player_tumbling_start  [N] a touch kind 14 hazard with a direction other than 0, 100 or 200; not produced
006C19-006C1B  player_state_opening_scene  [D] needs scene_step (20F0E2) = 0 when the player runs: it is cleared only at 001C7C, and the scene game-mode handlers (0942xx-0952xx) set it to 1 before run_objects in the same frame (run_frame runs the game mode, then the objects), so the players never see 0
006E3E-006E40  player_state_opening_scene  [D] needs scene_step (20F0E2) = 0 when the player runs: it is cleared only at 001C7C, and the scene game-mode handlers (0942xx-0952xx) set it to 1 before run_objects in the same frame (run_frame runs the game mode, then the objects), so the players never see 0
006F06-006F08  player_state_stage_scene  [D] needs scene_step (20F0E2) = 0 when the player runs: it is cleared only at 001C7C, and the scene game-mode handlers (0942xx-0952xx) set it to 1 before run_objects in the same frame (run_frame runs the game mode, then the objects), so the players never see 0
007A7C-007A7D  stuck_effect_update  [N] the effect object seeing its player at substep 0 of state 1D: the player would have to enter state 1D again while its previous effect object still exists; not produced
007C18-007C1A  player_state_scene_thrown  [D] needs scene_step (20F0E2) = 0 when the player runs: it is cleared only at 001C7C, and the scene game-mode handlers (0942xx-0952xx) set it to 1 before run_objects in the same frame (run_frame runs the game mode, then the objects), so the players never see 0
0085A9-0085AF  player_state_riding  [N] the stage 8 ride reaching x <= C11 (it is then clamped to C19); not produced
0096F6-0096F8  player_move_with_scroll  [N] hit_stop (player 2F, set to 3 by a jump kill at 00E760) still non-zero when the player enters state 25/26; not produced
00984D-00984F  player_move_with_scroll  [D] the drift: runs only in state 25 step 7 (009194), which sets the control lock to 10 every frame (00918E), so player_steer is skipped unless a wall clears it (00B735); floor type 8 exists only on stage 9's start slide (floor blocks 0-3), which has no walls; object field 6E is zeroed at 008FD0 and player field E3 is set to 1 at 008E26, 00916A, 009265 and never to 0
009853-009861  player_move_with_scroll  [D] the drift: runs only in state 25 step 7 (009194), which sets the control lock to 10 every frame (00918E), so player_steer is skipped unless a wall clears it (00B735); floor type 8 exists only on stage 9's start slide (floor blocks 0-3), which has no walls; object field 6E is zeroed at 008FD0 and player field E3 is set to 1 at 008E26, 00916A, 009265 and never to 0
00986B-0098D0  player_move_with_scroll  [D] the drift: runs only in state 25 step 7 (009194), which sets the control lock to 10 every frame (00918E), so player_steer is skipped unless a wall clears it (00B735); floor type 8 exists only on stage 9's start slide (floor blocks 0-3), which has no walls; object field 6E is zeroed at 008FD0 and player field E3 is set to 1 at 008E26, 00916A, 009265 and never to 0
009904-0099CC  player_move_with_scroll  [D] the drift: runs only in state 25 step 7 (009194), which sets the control lock to 10 every frame (00918E), so player_steer is skipped unless a wall clears it (00B735); floor type 8 exists only on stage 9's start slide (floor blocks 0-3), which has no walls; object field 6E is zeroed at 008FD0 and player field E3 is set to 1 at 008E26, 00916A, 009265 and never to 0
0099F1-0099F1  player_move_with_scroll  [N] keep_player_on_screen killing (state 16) or respawning (294A) a player carried by the scroll; not produced
00A47C-00A481  player_knocked_off_start  [D] floor-type branch: the saws (touch kind 26) are only on stages C and E, whose floor blocks (types 00 and 1C) give floor types 0 and 2
00A497-00A49A  player_knocked_off_start  [D] floor-type branch: the saws (touch kind 26) are only on stages C and E, whose floor blocks (types 00 and 1C) give floor types 0 and 2
00A4B4-00A4BB  player_knocked_off_start  [D] direction branch: touch kind 26 is set only by the object at 08B444, whose field 24 = 200 (08B44A) is never rewritten
00A4C8-00A4D1  player_knocked_off_start  [D] direction branch: touch kind 26 is set only by the object at 08B444, whose field 24 = 200 (08B44A) is never rewritten
00A574-00A577  player_knocked_off_fly  [D] floor-type branch: the saws (touch kind 26) are only on stages C and E, whose floor blocks (types 00 and 1C) give floor types 0 and 2
00BDBF-00BDC0  compute_ground_speed  [D] the rounding inc runs only if bit 11 of ground_speed (player 64) is set: the only call is the jsr at 008EF9 (player_state_pulled substate 5), and 008EF0 sets object speed 6E = 5000000 just before, so 64 = (6E >> 8) * direction factor is a multiple of 10000 and bit 11 is always 0
00F359-00F36D  spike_panel_update  [D] needs field 80 of object_cursor < 3 (bge at 00F34F) and = 5 (bne at 00F357), and nothing changes it between the two tests (the frame-5 sound sits in the frame < 3 branch)
0120FC-01210A  cactus_update  [D] repeats the test at 0120E4 (nearest_player_distance 16[R25] <= 60) that has just failed; fall_to_floor (08E391), the only call in between, does not write it
014DC2-014E51  draw_eel_piece_parts  [D] no jump, call, table or 32-bit value in the program refers to it (ROM search); it follows an rsr
0156F4-015705  spawn_eel_den  [D] no jump, call, table or 32-bit value in the program refers to it (ROM search); it follows an rsr
015A33-015A3B  init_stage_view  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
015A66-015A6B  init_stage_view  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
015E85-015E8A  get_tile_set_script_bank  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
015EA7-015EAA  get_tile_set_script_bank  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
015EC0-015EC5  get_tile_set_list_bank  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
015EE2-015EE3  get_tile_set_list_bank  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
015EFA-015EFF  get_tile_set_list  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
015F1C-015F1D  get_tile_set_list  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
015F44-015F49  clamp_camera_pixels  [D] the camera origin plus the section limits stay within x 10-1D50 and y 0-F96 (plus at most 8 of shake) in every stage that runs; x <= 0 occurs only on the paths of slots 01, 02, 11 and 12 (01, 02 and 12 stop the V60 at their start, 11 runs in game mode 18, which does not call update_stage_tile_layers)
015F55-015F5C  clamp_camera_pixels  [D] the camera origin plus the section limits stay within x 10-1D50 and y 0-F96 (plus at most 8 of shake) in every stage that runs; x <= 0 occurs only on the paths of slots 01, 02, 11 and 12 (01, 02 and 12 stop the V60 at their start, 11 runs in game mode 18, which does not call update_stage_tile_layers)
015F77-015F7E  clamp_camera_pixels  [D] the camera origin plus the section limits stay within x 10-1D50 and y 0-F96 (plus at most 8 of shake) in every stage that runs; x <= 0 occurs only on the paths of slots 01, 02, 11 and 12 (01, 02 and 12 stop the V60 at their start, 11 runs in game mode 18, which does not call update_stage_tile_layers)
016274-016276  is_player_pushing_edge  [D] cases 0, 3 and 5 of push_edge_case (209049): it is written only by set_screen_push_edges, with 1/2, 4, 6 and 7/8
01627D-01627F  is_player_pushing_edge  [D] cases 0, 3 and 5 of push_edge_case (209049): it is written only by set_screen_push_edges, with 1/2, 4, 6 and 7/8
016283-016285  is_player_pushing_edge  [D] cases 0, 3 and 5 of push_edge_case (209049): it is written only by set_screen_push_edges, with 1/2, 4, 6 and 7/8
01628F-016292  is_player_pushing_edge  [D] cases 0, 3 and 5 of push_edge_case (209049): it is written only by set_screen_push_edges, with 1/2, 4, 6 and 7/8
016307-01632C  is_player_pushing_edge  [D] cases 0, 3 and 5 of push_edge_case (209049): it is written only by set_screen_push_edges, with 1/2, 4, 6 and 7/8
01637B-0163A0  is_player_pushing_edge  [D] cases 0, 3 and 5 of push_edge_case (209049): it is written only by set_screen_push_edges, with 1/2, 4, 6 and 7/8
0164CB-0164D9  is_player_at_diagonal_edge_30  [D] each second test restates the first (y <= x/2 + R5 failing implies 2(y - R5) > x), so it can only pass on a 16-bit overflow, with a player about 4000 pixels off screen
01652B-016539  is_player_at_diagonal_edge_f0  [D] each second test restates the first (y <= x/2 + R5 failing implies 2(y - R5) > x), so it can only pass on a 16-bit overflow, with a player about 4000 pixels off screen
01658B-016599  is_player_at_diagonal_edge_c0  [D] each second test restates the first (y <= x/2 + R5 failing implies 2(y - R5) > x), so it can only pass on a 16-bit overflow, with a player about 4000 pixels off screen
0165E5-0165F3  is_player_at_diagonal_edge_60  [D] each second test restates the first (y <= x/2 + R5 failing implies 2(y - R5) > x), so it can only pass on a 16-bit overflow, with a player about 4000 pixels off screen
016726-016728  set_screen_push_edges_past_quadrant_0  [D] its only caller (01603C) passes R0 = 0 and only bits 0-3 come from the direction signs, so the index is always 1, 3, 7 or F
01672C-01672E  set_screen_push_edges_past_quadrant_0  [D] its only caller (01603C) passes R0 = 0 and only bits 0-3 come from the direction signs, so the index is always 1, 3, 7 or F
016732-01673A  set_screen_push_edges_past_quadrant_0  [D] its only caller (01603C) passes R0 = 0 and only bits 0-3 come from the direction signs, so the index is always 1, 3, 7 or F
01673E-016752  set_screen_push_edges_past_quadrant_0  [D] its only caller (01603C) passes R0 = 0 and only bits 0-3 come from the direction signs, so the index is always 1, 3, 7 or F
016A2F-016A43  scroll_speeding_up  [D] 016A09 is entered only through scroll_mode 2's entry of update_scroll's switch (br at 015FAF), and 016A26 tests scroll_mode = 2 again with no write in between
016C1B-016C1B  update_scroll_at_end  [D] a 20th entry (stage 13, the rsr after the 19 br of the table at 016BE2): stages run from 00 to 12
0171DC-0171E1  update_stage_00_exit_scene  [D] fixed scene timing: step 5 lasts 23 frames from speed 35 and ends at 11, never <= 2
017410-017417  update_stage_00_exit_scene  [D] fixed scene timing: step A's zoom goes from 200 down to DE when the scene ends, never below 42
01746C-0174C4  clamp_colour_offsets  [D] (the code after it, no label of its own) stage 3's end sequence (entered by the br at 016BEB to 017465 when scroll_position reaches scroll_end A600): the stage event at A360 switches to game mode 15, which forces scroll mode 1 (stop) every frame (0941EA) until the stage is cleared, so the game never gets there. stage_03_end_sequence.txt runs the rest of the sequence by poking past these two parts, which call run_vram_script with 145A46/146DD1 (set-up) and 146161 (end of the climb): those pointers start inside the previous script's last command, whose byte 8E makes run_vram_script jump to 09989C, a halt byte inside the br at 09989A that the static analysis cannot decode
017542-017582  clamp_colour_offsets  [D] (the code after it, no label of its own) stage 3's end sequence (entered by the br at 016BEB to 017465 when scroll_position reaches scroll_end A600): the stage event at A360 switches to game mode 15, which forces scroll mode 1 (stop) every frame (0941EA) until the stage is cleared, so the game never gets there. stage_03_end_sequence.txt runs the rest of the sequence by poking past these two parts, which call run_vram_script with 145A46/146DD1 (set-up) and 146161 (end of the climb): those pointers start inside the previous script's last command, whose byte 8E makes run_vram_script jump to 09989C, a halt byte inside the br at 09989A that the static analysis cannot decode
017902-01790A  update_stage_06_background  [D] needs bits 8-12 of 20F1DE: init_stage_view clears 20F1DE for stage 6 (015A45 -> 015A6C) and step 0 keeps only those bits
01792A-017932  update_stage_06_background  [H] reads palette RAM 60C3A0 right after writing 7B0 there: fails only if palette RAM loses a write
017ADB-017AE0  update_stage_06_background  [D] stage_06_shake (20E5C6) going below 0: it is only ever set to 0 or 800 (000A76, 001094, 017AB2, 0841A6) and counts down by 80, so it reaches exactly 0
01B033-01B03B  load_palette_set_and_backdrop  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12); otherwise it is called only by build_ending_scene (01BD05, stage 11)
01B069-01B06B  load_palette_set_and_backdrop  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12); otherwise it is called only by build_ending_scene (01BD05, stage 11)
01B30B-01B313  init_nbg1_layer  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
01B33E-01B343  init_nbg1_layer  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
01B44F-01B457  init_nbg2_layer  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
01B482-01B487  init_nbg2_layer  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
01B491-01B4F6  init_nbg2_layer  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
01B63F-01B647  init_nbg3_layer  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
01B672-01B677  init_nbg3_layer  [D] stage slots 00, 01, 02, 11 and 12 only: init_stage_view's only caller start_stage_view (016CE3) skips stage 11; slots 01, 02 and 12 are never entered (stage_order at 002639 never gives them and Stage Select slots 01/02 come back as 07); stage 0 is entered only through run_stage_05_switch, which loads fixed VRAM scripts with the scroll already ended, so no tile set is loaded for it; poking the stage to any of these slots before start_stage stops the V60 in the first load_tile_set (their tile set lists at 1705DA hold 0007xxxx pointers without the 100000 bank: "AM1" at 099902 for slot 00, "unhandled opcode 37" at 099892 for 01, 02, 12)
01B8D7-01B8D9  update_nbg3_scroll  [D] the 20th entry (stage 13) of the table at 01B89E: stages run from 00 to 12
01CA72-01CA72  ending_portrait_show  [D] both time tables end with 398, 730, AC8, FFFF: past AC8 the first loop frees and deletes the object (01CA14) before the second loop can run out
01E822-01E82C  scatter_rings  [D] needs the scattering object to have flag 4: only players (00B5D4), carried and scattered rings (01E684, 01E97F) and bouncing fireballs (082DC5) get it, and none of them scatters rings (the callers are 00F901, 08E548 and 0826F5)
01E8E7-01E90A  move_scattered_ring  [N] a moving scattered ring meeting a floor more than 8 higher (only one ring of a scatter moves, toward +y +-45 degrees); not produced
0806DA-0806DC  spiked_roller_chase_rumble  [D] sign test (bp) of a 16-bit value just shifted right logically by 4 (shl.h #FC): it can never be negative
08092A-08092C  spiked_roller_ram  [D] sign test (bp) of a 16-bit value just shifted right logically by 4 (shl.h #FC): it can never be negative
080932-080934  spiked_roller_ram  [D] the ram cases set chaser_speed to 40/0/10/40 just before, so chaser_speed >> 4 is at most 4
080AFA-080AFC  spiked_roller_crash_into_machine  [D] chaser_speed is set to 10 at 080ADB just before, so R0 = 1, never above 5
080B48-080B4A  spiked_roller_roll_into_machine  [D] sign test (bp) of a 16-bit value just shifted right logically by 4 (shl.h #FC): it can never be negative
084089-08408B  opening_machine_update  [D] scene_step 0's case: game mode 10 (094502) runs before the objects and turns scene_step 0 into 1 (09451C) before it spawns the machine (094526), and the machine exists only in mode 10
08E0FF-08E104  delete_object_and_children  [D] a debugging trap (jmp int_default) when free_object_stack_2 exceeds 100 after a free: needs a double free (a corrupt pool)
08E1A8-08E1B4  copy_screen_position_from_cursor  [D] its only caller (014E32) is inside draw_eel_piece_parts (014DC2), which nothing refers to
08E5D2-08E5EB  drop_rings  [D] needs released_ring_flip (208034) = 1: it is written only with 0 (0113E8, 012EDB, 013088, 0132DF, 0150A2) or 2 (0147D6, 0157A9), each time right before calling drop_rings
09016D-09016D  join_character_chooser_update  [D] needs its player's bit clear in players_in_join_chooser (208091): the bit is set at 0900D0 and cleared at 090206 when the chooser ends, so the update never runs without it (a one-frame poke would reach it)
0916CF-0916D4  crumbling_floor_start_falling  [D] state 2 starts at animation frame 4 (091605) and the animation stops at step 6, so its test of field 46 <= 2 never holds
09510E-09510F  game_mode_event_1c_case_00  [D] scene_step 0's entry: 095053-095059 set scene_step to 1 when it is 0, just before the dispatch
0967F1-0967F5  start_window_wipe  [D] its three callers (0959E3, 095F3E, 0960FD) pass map_wipe_in/out/next_windows[stage]: no record has y >= 60 (the largest is 39)
0967FB-0967FE  start_window_wipe  [D] the same records (see 0967F1): no record has x <= 0 (the smallest is 1)
096804-096807  start_window_wipe  [D] the same records (see 0967F1): no record has y <= 0 (the smallest is 8)
096A41-096A49  update_screen_wipe  [D] R5's low byte is cleared at 096942 and only bits 0-3 are ever set, so cmp.h #FFFF, R5 (096A39) never matches
09824E-098250  run_sega_logo  [D] step 0's jump-table entry: the set-up (098174-09822F) runs when 209083 is 0 and increments it before the dispatch
09911A-099128  convert_to_bcd  [D] needs a value >= 100000000 (decimal): every caller passes a byte, a halfword, a sum of two halfwords or a split_frame_count result (days, under 55 million)
099302-099304  delete_object  [D] needs the list's first object (R22) to be the one deleted: the callers delete a catapult's partner (08105F) or an object's children (08E105), all younger than the first object (player 1's object 204F60 in a stage)
099885-09988D  run_vram_script  [D] dictionary words (bytes below 80): only stage 3's end scripts (145A46 and 146161 start with 03) have them, and the game never runs that sequence (see 01746C)
0998A0-0998A2  vram_script_words_entry  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
0998A3-0998A5  vram_script_words_to_dictionary_entry  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
0998A9-0998AB  vram_script_fill_down_entry  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
0998AC-0998AE  vram_script_fill_down_wide_entry  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
0998AF-0998B1  vram_script_fill_up_entry  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
0998B2-0998B4  vram_script_repeat_entry  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
0998B5-0998B7  vram_script_skip_long_entry  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
0998D0-0998D7  vram_script_skip_long  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
09991A-099925  vram_script_words  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
099926-099939  vram_script_words_to_dictionary  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
099955-099966  vram_script_fill_down  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
099967-099978  vram_script_fill_up  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
099979-09998B  vram_script_fill_down_wide  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
09998C-099999  vram_script_repeat  [D] VRAM script commands 92, 95, 9B, 9E, A1, A4, A7 (and their table entries at 09988E + command - 80): no ROM script uses them, and every call of run_vram_script passes a ROM script (61 constants, plus 015E6E from the stage_tile_sets lists at 01A695); parsing the 55 constant scripts and the 587 tile-set scripts finds only commands 80, 83, 86, 89, 8C, 8F, 98, AA, dictionary bytes and the stray 8E of stage 3's end scripts
09A18D-09A18F  queue_sprite_at_previous_floor_2  [N] a stage 3 spike panel whose part 1 floor point is more than 16 above the view while the head survives (spike_panel_update 00F211 destroys the panel unless the spiked roller is above it); not produced
09A2E3-09A2E3  build_sprite_list_write_entry  [D] nop padding between the entries of the jump table at 09A2E0: the offset (sprite_flags rotated, & 34) is only 0, 4, 10, 14, 20, 24, 30 or 34
09A2E7-09A2EF  build_sprite_list_write_entry  [D] nop padding of the jump table at 09A2E0 (see 09A2E3)
09A2F3-09A2F3  build_sprite_list_write_entry  [D] nop padding of the jump table at 09A2E0 (see 09A2E3)
09A2F7-09A2FF  build_sprite_list_write_entry  [D] nop padding of the jump table at 09A2E0 (see 09A2E3)
09A303-09A303  build_sprite_list_write_entry  [D] nop padding of the jump table at 09A2E0 (see 09A2E3)
09A307-09A30F  build_sprite_list_write_entry  [D] nop padding of the jump table at 09A2E0 (see 09A2E3)
09A313-09A313  build_sprite_list_write_entry  [D] nop padding of the jump table at 09A2E0 (see 09A2E3)
09A400-09A405  build_sprite_list_y_not_flipped  [D] a debugging trap (jmp int_default) for a multi-part sprite of 11 or more parts: no sprite has that many
09A785-09A787  set_bitmap_window  [D] swaps the corners when out of order: its only call (09A72C) passes 0, 0, 1FF, DF, already in order
09A78D-09A78F  set_bitmap_window  [D] the same swap for y (see 09A785)
09C3DB-09C3DD  clip_line_to_window_case_03  [D] outcode 3 needs x < left and x > right at once; a case is only dispatched when the other end has neither bit (09A879), which no window, not even an inverted one, allows
09C3E7-09C3E9  clip_line_to_window_case_07  [D] outcode 7: the same impossible combination (see 09C3DB)
09C69B-09C6B2  load_settings  [H] needs an EEPROM settings copy with a bad CRC next to an intact backup: eeprom_save, the only chip writer (09C792), writes both copies from one RAM image with a fresh CRC (a damaged chip or a write cut short)
09CCBB-09CCC7  test_memory  [H] prints the failed chips: needs memory_test_errors (20CA50) non-zero, which only the ROM and RAM tests' failures set (cleared at 09CB9C in the same call)
09CCE5-09CCEC  test_memory  [H] the same failure report (see 09CCBB)
09CD62-09CD67  check_rom_checksums  [H] needs a ROM whose sum differs from the one stored (a bad ROM)
09CD82-09CD87  check_rom_checksums  [H] needs a ROM whose sum differs from the one stored (a bad ROM)
09CDA2-09CDA7  check_rom_checksums  [H] needs a ROM whose sum differs from the one stored (a bad ROM)
09CDC2-09CDC7  check_rom_checksums  [H] needs a ROM whose sum differs from the one stored (a bad ROM)
09CE4C-09CE60  test_work_ram_verify  [H] needs a chip that does not hold what was written (a faulty RAM): MEMORY TEST runs the whole test inside one frame's code with interrupts off (09CB70-09CBD3), and pokes reach memory only at the frame wait (098ED6), so no poke can change what it reads back
09CEFB-09CF70  test_video_ram_verify  [H] needs a chip that does not hold what was written (a faulty RAM): MEMORY TEST runs the whole test inside one frame's code with interrupts off (09CB70-09CBD3), and pokes reach memory only at the frame wait (098ED6), so no poke can change what it reads back
09CFEF-09D060  test_sprite_ram_verify  [H] needs a chip that does not hold what was written (a faulty RAM): MEMORY TEST runs the whole test inside one frame's code with interrupts off (09CB70-09CBD3), and pokes reach memory only at the frame wait (098ED6), so no poke can change what it reads back
09D0D7-09D112  test_palette_ram_verify_first_half  [H] needs a chip that does not hold what was written (a faulty RAM): MEMORY TEST runs the whole test inside one frame's code with interrupts off (09CB70-09CBD3), and pokes reach memory only at the frame wait (098ED6), so no poke can change what it reads back
09D188-09D1CB  test_palette_ram_verify_second_half  [H] needs a chip that does not hold what was written (a faulty RAM): MEMORY TEST runs the whole test inside one frame's code with interrupts off (09CB70-09CBD3), and pokes reach memory only at the frame wait (098ED6), so no poke can change what it reads back
09D257-09D25C  test_sound_ram_verify  [H] needs a chip that does not hold what was written (a faulty RAM): MEMORY TEST runs the whole test inside one frame's code with interrupts off (09CB70-09CBD3), and pokes reach memory only at the frame wait (098ED6), so no poke can change what it reads back
09D8CC-09D8CE  test_crt  [D] step 0's jump-table entry: the step (20CA1D) is set to 1 before the dispatch
09D8DB-09D8DB  test_crt  [D] step 0's code (see 09D8CC)
09F500-09F505  irq_vblank_start  [T] runs at every VBLANK start, but s32ref raises the interrupt inside its instruction hook, so a handler's first instruction runs unrecorded unless the handler starts right after another one's retis; VBLANK start is always taken from the frame wait. 09F506-09F55D are recorded in every scenario
09F578-09F581  irq_sound  [H] the sound CPU's interrupt: the board model has no sound CPU and never signals S32_IRQ_SOUND (runtime/src/machine.c raises only VBLANK start/end and the two timers)
09F5B8-09F5BB  int_default  [D] four halts, the target of 247 of the 256 vectors: every CPU exception (zero divide, reserved instruction...) and every vector the program does not use. The interrupt controller supplies only 00-04 (vectors 40-44, set at boot 000031-00003F), the program has no BRK, CHLVL or TRAP, no scenario raises an exception, and the two jumps to it (08E0FF, 09A400) are debugging traps that never trigger: it would run only if the game hit a CPU exception
09F5BC-09F5BF  int_vector_02  [H] the NMI handler (four halts): nothing on the board model drives the NMI (s32ref drives only the CPU's input line 0)
09F782-09F782  update_coins  [D] its only call (09F531) is skipped when free_play (20F401) is set (09F52B), and the rsr needs 20F401 set at the second test of the same interrupt handler
