Viewing Issue Advanced Details
[ Jump to Notes ]
merit/merit.cpp
ID Category [?] Severity [?] Reproducibility Date Submitted Last Update
02539 Crash/Freeze Critical (emulator) Always Oct 13, 2008, 08:28 Oct 16, 2008, 06:05
Tester Firewave View Status Public Platform MAME (Self-compiled)
Assigned To couriersud Resolution Fixed OS
Status [?] Resolved Driver
merit/merit.cpp
Version 0.127u7 Fixed in Version 0.128 Build Debug
Fixed in Git Commit Github Pull Request #
Summary 02539: phrcraze, phrcrazes: [debug] Access Violation
Description -----------------------------------------------------
Exception at EIP=0062C23F (video_update_meadows+0x068e): ACCESS VIOLATION
While attempting to read memory at 11DB2000
-----------------------------------------------------
EAX=11DB2000 EBX=00000040 ECX=00000000 EDX=00001000
ESI=FFFFFFFF EDI=0062C184 EBP=0022FA78 ESP=0022FA00
Steps To Reproduce
Additional Information phrcrazs -> phrcrazes in 0.133u1
phrcrazes - > phrcrazev in 0.138
Github Commit
Flags Debug build specific
Regression Version 0.127u7
Affected Sets / Systems phrcraze, phrcrazes
Attached Files
  
Relationships
There are no relationship linked to this issue.
Notes
3
User avatar
No.02836
couriersud
Developer
Oct 14, 2008, 07:13
 This is completely weird. video_update_meadows is not referred in the merit.c driver at all.
The bug does not reproduce on sdlmame (linux) as well.
Can you please provide a backtrace?
User avatar
No.02839
Firewave
Senior Tester
Oct 14, 2008, 08:23
 The .map file gives to give wrong information about the actual function (usually does that). Here's a proper backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,
    cliprect=0x22f904, ma=4096, ra=0 '
Program received signal SIGSEGV, Segmentation fault.

0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904, ma=4096, ra=0 '\0', y=264, x_count=64 '@',

    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204

204                     int addr = ((ram_video[ma] | ((attr & 0x80) << 1) | (ext

ra_video_bank_bit)) << 4) | (ra & 0x0f);

(gdb) bt full

#0  0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904, ma=4096, ra=0 '\0', y=264, x_count=64 '@',

    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204

        i = -1

        region = 0

        colour = 0

        data = (UINT8 *) 0x12a51ffc ""

        attr = 0

        addr = 7

        cx = 0 '\0'

        pens = (pen_t *) 0x2333ce0

        gfx = {0x12a51ffc "", 0x12a81ffc ""}

        x = 0

        rlen = 32768

#1  0x009f7545 in mc6845_update (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904) at src/emu/video/mc6845.c:659

        ra = 0 '\0'

        cursor_visible = 0

        cursor_x = -1 ' '

        y = 264

        param = (void *) 0x2333ce0

        mc6845 = (mc6845_t *) 0x13fa1fa0

#2  0x005f496b in video_update_merit (screen=0xb821f74, bitmap=0x14791fe0,

    cliprect=0x22f904) at src/mame/drivers/merit.c:845

        mc6845 = (const device_config *) 0xb831fbc

#3  0x00997685 in video_screen_update_partial (screen=0xb821f74, scanline=267)

    at src/emu/video.c:848

        flags = 1

        state = (screen_state *) 0x13f91f20

        clip = {min_x = 0, max_x = 511, min_y = 12, max_y = 267}

        result = 0

#4  0x0099927d in finish_screen_updates (machine=0xb781f34)

    at src/emu/video.c:1556

        screen = (const device_config *) 0xb821f74

        anything_changed = 0

#5  0x00998fbc in video_frame_update (machine=0xb781f34, debug=0)

    at src/emu/video.c:1488

        anything_changed = 2292408

        current_time = {seconds = 0, attoseconds = 115062400000000000}

        skipped_it = 0

        phase = 3

#6  0x00998c40 in vblank_begin_callback (machine=0xb781f34, ptr=0xb821f74,

    param=0) at src/emu/video.c:1380

        i = 1

        screen = (device_config *) 0xb821f74

        state = (screen_state *) 0x13f91f20

#7  0x009bc22f in timer_set_global_time (machine=0xb781f34, newbase=

      {seconds = 0, attoseconds = 115062400000000000}) at src/emu/timer.c:359

        was_enabled = 1

        timer = (emu_timer *) 0x2b22560

#8  0x009c4f5a in cpuexec_timeslice (machine=0xb781f34)

    at src/emu/cpuexec.c:335

        target = {seconds = 0, attoseconds = 115062400000000000}

        base = {seconds = 0, attoseconds = 114320800000000000}

        cpunum = 1

        ran = 1860

#9  0x0098317b in mame_execute (options=0x8a91e58) at src/emu/mame.c:345

        settingsloaded = 0

        driver = (const game_driver *) 0x17feb50

        machine = (running_machine *) 0xb781f34

        mame = (mame_private *) 0xb791f68

        cb = (callback_item *) 0x8a91e58

        gamename = (astring *) 0xb781f00

        exit_pending = 0

        error = 0

        firstgame = 0

        firstrun = 0

#10 0x00ba2e4c in cli_execute (argc=6, argv=0x89f1fe8, osd_options=0x21149b0)

    at src/emu/clifront.c:171

        options = (core_options *) 0x8a91e58

        gamename = (astring *) 0x8a71f00

        exename = (astring *) 0x8a81f00

        gamename_option = 0x8ac1f08 "phrcraze"

        driver = (const game_driver *) 0x17feb50

        result = -1

#11 0x00928fa8 in utf8_main (argc=6, argv=0x89f1fe8)

    at src/osd/windows/winmain.c:257

        ext = 0x286c498 ".map"

#12 0x011fd2e9 in main (argc=6, a_argv=0x6e92758) at src/osd/windows/main.c:72

        i = 6

        rc = 2293624

        utf8_argv = (char **) 0x89f1fe8

        argv = (TCHAR **) 0x6e92838

        wenviron = (WCHAR **) 0x6e95080


', y=264, x_count=64 '@',
    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204
204                     int addr = ((ram_video[ma] | ((attr & 0x80) << 1) | (ext
ra_video_bank_bit)) << 4) | (ra & 0x0f);
(gdb) bt full
#0  0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,
    cliprect=0x22f904, ma=4096, ra=0 '
Program received signal SIGSEGV, Segmentation fault.

0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904, ma=4096, ra=0 '\0', y=264, x_count=64 '@',

    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204

204                     int addr = ((ram_video[ma] | ((attr & 0x80) << 1) | (ext

ra_video_bank_bit)) << 4) | (ra & 0x0f);

(gdb) bt full

#0  0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904, ma=4096, ra=0 '\0', y=264, x_count=64 '@',

    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204

        i = -1

        region = 0

        colour = 0

        data = (UINT8 *) 0x12a51ffc ""

        attr = 0

        addr = 7

        cx = 0 '\0'

        pens = (pen_t *) 0x2333ce0

        gfx = {0x12a51ffc "", 0x12a81ffc ""}

        x = 0

        rlen = 32768

#1  0x009f7545 in mc6845_update (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904) at src/emu/video/mc6845.c:659

        ra = 0 '\0'

        cursor_visible = 0

        cursor_x = -1 ' '

        y = 264

        param = (void *) 0x2333ce0

        mc6845 = (mc6845_t *) 0x13fa1fa0

#2  0x005f496b in video_update_merit (screen=0xb821f74, bitmap=0x14791fe0,

    cliprect=0x22f904) at src/mame/drivers/merit.c:845

        mc6845 = (const device_config *) 0xb831fbc

#3  0x00997685 in video_screen_update_partial (screen=0xb821f74, scanline=267)

    at src/emu/video.c:848

        flags = 1

        state = (screen_state *) 0x13f91f20

        clip = {min_x = 0, max_x = 511, min_y = 12, max_y = 267}

        result = 0

#4  0x0099927d in finish_screen_updates (machine=0xb781f34)

    at src/emu/video.c:1556

        screen = (const device_config *) 0xb821f74

        anything_changed = 0

#5  0x00998fbc in video_frame_update (machine=0xb781f34, debug=0)

    at src/emu/video.c:1488

        anything_changed = 2292408

        current_time = {seconds = 0, attoseconds = 115062400000000000}

        skipped_it = 0

        phase = 3

#6  0x00998c40 in vblank_begin_callback (machine=0xb781f34, ptr=0xb821f74,

    param=0) at src/emu/video.c:1380

        i = 1

        screen = (device_config *) 0xb821f74

        state = (screen_state *) 0x13f91f20

#7  0x009bc22f in timer_set_global_time (machine=0xb781f34, newbase=

      {seconds = 0, attoseconds = 115062400000000000}) at src/emu/timer.c:359

        was_enabled = 1

        timer = (emu_timer *) 0x2b22560

#8  0x009c4f5a in cpuexec_timeslice (machine=0xb781f34)

    at src/emu/cpuexec.c:335

        target = {seconds = 0, attoseconds = 115062400000000000}

        base = {seconds = 0, attoseconds = 114320800000000000}

        cpunum = 1

        ran = 1860

#9  0x0098317b in mame_execute (options=0x8a91e58) at src/emu/mame.c:345

        settingsloaded = 0

        driver = (const game_driver *) 0x17feb50

        machine = (running_machine *) 0xb781f34

        mame = (mame_private *) 0xb791f68

        cb = (callback_item *) 0x8a91e58

        gamename = (astring *) 0xb781f00

        exit_pending = 0

        error = 0

        firstgame = 0

        firstrun = 0

#10 0x00ba2e4c in cli_execute (argc=6, argv=0x89f1fe8, osd_options=0x21149b0)

    at src/emu/clifront.c:171

        options = (core_options *) 0x8a91e58

        gamename = (astring *) 0x8a71f00

        exename = (astring *) 0x8a81f00

        gamename_option = 0x8ac1f08 "phrcraze"

        driver = (const game_driver *) 0x17feb50

        result = -1

#11 0x00928fa8 in utf8_main (argc=6, argv=0x89f1fe8)

    at src/osd/windows/winmain.c:257

        ext = 0x286c498 ".map"

#12 0x011fd2e9 in main (argc=6, a_argv=0x6e92758) at src/osd/windows/main.c:72

        i = 6

        rc = 2293624

        utf8_argv = (char **) 0x89f1fe8

        argv = (TCHAR **) 0x6e92838

        wenviron = (WCHAR **) 0x6e95080


', y=264, x_count=64 '@',
    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204
        i = -1
        region = 0
        colour = 0
        data = (UINT8 *) 0x12a51ffc ""
        attr = 0
        addr = 7
        cx = 0 '
Program received signal SIGSEGV, Segmentation fault.

0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904, ma=4096, ra=0 '\0', y=264, x_count=64 '@',

    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204

204                     int addr = ((ram_video[ma] | ((attr & 0x80) << 1) | (ext

ra_video_bank_bit)) << 4) | (ra & 0x0f);

(gdb) bt full

#0  0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904, ma=4096, ra=0 '\0', y=264, x_count=64 '@',

    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204

        i = -1

        region = 0

        colour = 0

        data = (UINT8 *) 0x12a51ffc ""

        attr = 0

        addr = 7

        cx = 0 '\0'

        pens = (pen_t *) 0x2333ce0

        gfx = {0x12a51ffc "", 0x12a81ffc ""}

        x = 0

        rlen = 32768

#1  0x009f7545 in mc6845_update (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904) at src/emu/video/mc6845.c:659

        ra = 0 '\0'

        cursor_visible = 0

        cursor_x = -1 ' '

        y = 264

        param = (void *) 0x2333ce0

        mc6845 = (mc6845_t *) 0x13fa1fa0

#2  0x005f496b in video_update_merit (screen=0xb821f74, bitmap=0x14791fe0,

    cliprect=0x22f904) at src/mame/drivers/merit.c:845

        mc6845 = (const device_config *) 0xb831fbc

#3  0x00997685 in video_screen_update_partial (screen=0xb821f74, scanline=267)

    at src/emu/video.c:848

        flags = 1

        state = (screen_state *) 0x13f91f20

        clip = {min_x = 0, max_x = 511, min_y = 12, max_y = 267}

        result = 0

#4  0x0099927d in finish_screen_updates (machine=0xb781f34)

    at src/emu/video.c:1556

        screen = (const device_config *) 0xb821f74

        anything_changed = 0

#5  0x00998fbc in video_frame_update (machine=0xb781f34, debug=0)

    at src/emu/video.c:1488

        anything_changed = 2292408

        current_time = {seconds = 0, attoseconds = 115062400000000000}

        skipped_it = 0

        phase = 3

#6  0x00998c40 in vblank_begin_callback (machine=0xb781f34, ptr=0xb821f74,

    param=0) at src/emu/video.c:1380

        i = 1

        screen = (device_config *) 0xb821f74

        state = (screen_state *) 0x13f91f20

#7  0x009bc22f in timer_set_global_time (machine=0xb781f34, newbase=

      {seconds = 0, attoseconds = 115062400000000000}) at src/emu/timer.c:359

        was_enabled = 1

        timer = (emu_timer *) 0x2b22560

#8  0x009c4f5a in cpuexec_timeslice (machine=0xb781f34)

    at src/emu/cpuexec.c:335

        target = {seconds = 0, attoseconds = 115062400000000000}

        base = {seconds = 0, attoseconds = 114320800000000000}

        cpunum = 1

        ran = 1860

#9  0x0098317b in mame_execute (options=0x8a91e58) at src/emu/mame.c:345

        settingsloaded = 0

        driver = (const game_driver *) 0x17feb50

        machine = (running_machine *) 0xb781f34

        mame = (mame_private *) 0xb791f68

        cb = (callback_item *) 0x8a91e58

        gamename = (astring *) 0xb781f00

        exit_pending = 0

        error = 0

        firstgame = 0

        firstrun = 0

#10 0x00ba2e4c in cli_execute (argc=6, argv=0x89f1fe8, osd_options=0x21149b0)

    at src/emu/clifront.c:171

        options = (core_options *) 0x8a91e58

        gamename = (astring *) 0x8a71f00

        exename = (astring *) 0x8a81f00

        gamename_option = 0x8ac1f08 "phrcraze"

        driver = (const game_driver *) 0x17feb50

        result = -1

#11 0x00928fa8 in utf8_main (argc=6, argv=0x89f1fe8)

    at src/osd/windows/winmain.c:257

        ext = 0x286c498 ".map"

#12 0x011fd2e9 in main (argc=6, a_argv=0x6e92758) at src/osd/windows/main.c:72

        i = 6

        rc = 2293624

        utf8_argv = (char **) 0x89f1fe8

        argv = (TCHAR **) 0x6e92838

        wenviron = (WCHAR **) 0x6e95080


'
        pens = (pen_t *) 0x2333ce0
        gfx = {0x12a51ffc "", 0x12a81ffc ""}
        x = 0
        rlen = 32768
#1  0x009f7545 in mc6845_update (device=0xb831fbc, bitmap=0x14791fe0,
    cliprect=0x22f904) at src/emu/video/mc6845.c:659
        ra = 0 '
Program received signal SIGSEGV, Segmentation fault.

0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904, ma=4096, ra=0 '\0', y=264, x_count=64 '@',

    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204

204                     int addr = ((ram_video[ma] | ((attr & 0x80) << 1) | (ext

ra_video_bank_bit)) << 4) | (ra & 0x0f);

(gdb) bt full

#0  0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904, ma=4096, ra=0 '\0', y=264, x_count=64 '@',

    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204

        i = -1

        region = 0

        colour = 0

        data = (UINT8 *) 0x12a51ffc ""

        attr = 0

        addr = 7

        cx = 0 '\0'

        pens = (pen_t *) 0x2333ce0

        gfx = {0x12a51ffc "", 0x12a81ffc ""}

        x = 0

        rlen = 32768

#1  0x009f7545 in mc6845_update (device=0xb831fbc, bitmap=0x14791fe0,

    cliprect=0x22f904) at src/emu/video/mc6845.c:659

        ra = 0 '\0'

        cursor_visible = 0

        cursor_x = -1 ' '

        y = 264

        param = (void *) 0x2333ce0

        mc6845 = (mc6845_t *) 0x13fa1fa0

#2  0x005f496b in video_update_merit (screen=0xb821f74, bitmap=0x14791fe0,

    cliprect=0x22f904) at src/mame/drivers/merit.c:845

        mc6845 = (const device_config *) 0xb831fbc

#3  0x00997685 in video_screen_update_partial (screen=0xb821f74, scanline=267)

    at src/emu/video.c:848

        flags = 1

        state = (screen_state *) 0x13f91f20

        clip = {min_x = 0, max_x = 511, min_y = 12, max_y = 267}

        result = 0

#4  0x0099927d in finish_screen_updates (machine=0xb781f34)

    at src/emu/video.c:1556

        screen = (const device_config *) 0xb821f74

        anything_changed = 0

#5  0x00998fbc in video_frame_update (machine=0xb781f34, debug=0)

    at src/emu/video.c:1488

        anything_changed = 2292408

        current_time = {seconds = 0, attoseconds = 115062400000000000}

        skipped_it = 0

        phase = 3

#6  0x00998c40 in vblank_begin_callback (machine=0xb781f34, ptr=0xb821f74,

    param=0) at src/emu/video.c:1380

        i = 1

        screen = (device_config *) 0xb821f74

        state = (screen_state *) 0x13f91f20

#7  0x009bc22f in timer_set_global_time (machine=0xb781f34, newbase=

      {seconds = 0, attoseconds = 115062400000000000}) at src/emu/timer.c:359

        was_enabled = 1

        timer = (emu_timer *) 0x2b22560

#8  0x009c4f5a in cpuexec_timeslice (machine=0xb781f34)

    at src/emu/cpuexec.c:335

        target = {seconds = 0, attoseconds = 115062400000000000}

        base = {seconds = 0, attoseconds = 114320800000000000}

        cpunum = 1

        ran = 1860

#9  0x0098317b in mame_execute (options=0x8a91e58) at src/emu/mame.c:345

        settingsloaded = 0

        driver = (const game_driver *) 0x17feb50

        machine = (running_machine *) 0xb781f34

        mame = (mame_private *) 0xb791f68

        cb = (callback_item *) 0x8a91e58

        gamename = (astring *) 0xb781f00

        exit_pending = 0

        error = 0

        firstgame = 0

        firstrun = 0

#10 0x00ba2e4c in cli_execute (argc=6, argv=0x89f1fe8, osd_options=0x21149b0)

    at src/emu/clifront.c:171

        options = (core_options *) 0x8a91e58

        gamename = (astring *) 0x8a71f00

        exename = (astring *) 0x8a81f00

        gamename_option = 0x8ac1f08 "phrcraze"

        driver = (const game_driver *) 0x17feb50

        result = -1

#11 0x00928fa8 in utf8_main (argc=6, argv=0x89f1fe8)

    at src/osd/windows/winmain.c:257

        ext = 0x286c498 ".map"

#12 0x011fd2e9 in main (argc=6, a_argv=0x6e92758) at src/osd/windows/main.c:72

        i = 6

        rc = 2293624

        utf8_argv = (char **) 0x89f1fe8

        argv = (TCHAR **) 0x6e92838

        wenviron = (WCHAR **) 0x6e95080


'
        cursor_visible = 0
        cursor_x = -1 ' '
        y = 264
        param = (void *) 0x2333ce0
        mc6845 = (mc6845_t *) 0x13fa1fa0
#2  0x005f496b in video_update_merit (screen=0xb821f74, bitmap=0x14791fe0,
    cliprect=0x22f904) at src/mame/drivers/merit.c:845
        mc6845 = (const device_config *) 0xb831fbc
#3  0x00997685 in video_screen_update_partial (screen=0xb821f74, scanline=267)
    at src/emu/video.c:848
        flags = 1
        state = (screen_state *) 0x13f91f20
        clip = {min_x = 0, max_x = 511, min_y = 12, max_y = 267}
        result = 0
#4  0x0099927d in finish_screen_updates (machine=0xb781f34)
    at src/emu/video.c:1556
        screen = (const device_config *) 0xb821f74
        anything_changed = 0
#5  0x00998fbc in video_frame_update (machine=0xb781f34, debug=0)
    at src/emu/video.c:1488
        anything_changed = 2292408
        current_time = {seconds = 0, attoseconds = 115062400000000000}
        skipped_it = 0
        phase = 3
#6  0x00998c40 in vblank_begin_callback (machine=0xb781f34, ptr=0xb821f74,
    param=0) at src/emu/video.c:1380
        i = 1
        screen = (device_config *) 0xb821f74
        state = (screen_state *) 0x13f91f20
#7  0x009bc22f in timer_set_global_time (machine=0xb781f34, newbase=
      {seconds = 0, attoseconds = 115062400000000000}) at src/emu/timer.c:359
        was_enabled = 1
        timer = (emu_timer *) 0x2b22560
#8  0x009c4f5a in cpuexec_timeslice (machine=0xb781f34)
    at src/emu/cpuexec.c:335
        target = {seconds = 0, attoseconds = 115062400000000000}
        base = {seconds = 0, attoseconds = 114320800000000000}
        cpunum = 1
        ran = 1860
#9  0x0098317b in mame_execute (options=0x8a91e58) at src/emu/mame.c:345
        settingsloaded = 0
        driver = (const game_driver *) 0x17feb50
        machine = (running_machine *) 0xb781f34
        mame = (mame_private *) 0xb791f68
        cb = (callback_item *) 0x8a91e58
        gamename = (astring *) 0xb781f00
        exit_pending = 0
        error = 0
        firstgame = 0
        firstrun = 0
#10 0x00ba2e4c in cli_execute (argc=6, argv=0x89f1fe8, osd_options=0x21149b0)
    at src/emu/clifront.c:171
        options = (core_options *) 0x8a91e58
        gamename = (astring *) 0x8a71f00
        exename = (astring *) 0x8a81f00
        gamename_option = 0x8ac1f08 "phrcraze"
        driver = (const game_driver *) 0x17feb50
        result = -1
#11 0x00928fa8 in utf8_main (argc=6, argv=0x89f1fe8)
    at src/osd/windows/winmain.c:257
        ext = 0x286c498 ".map"
#12 0x011fd2e9 in main (argc=6, a_argv=0x6e92758) at src/osd/windows/main.c:72
        i = 6
        rc = 2293624
        utf8_argv = (char **) 0x89f1fe8
        argv = (TCHAR **) 0x6e92838
        wenviron = (WCHAR **) 0x6e95080
User avatar
No.02855
couriersud
Developer
Oct 16, 2008, 00:45
 The code where it happens is

int addr = ((ram_video[ma] | ((attr & 0x80) << 1) | (extra_video_bank_bit)) << 4) | (ra & 0x0f);

ma = 4096 on scanline 264. ram_video only has a size of 4096. 264 also looks like being in the vblank area. However clip indicates visible area till 267.
Weird. Putting in (ma &07ff) properly reflects the schematics. Only lines MA0 to MA10 are hooked up.