diff --git a/harness/udpstream/bench-sweep.sh b/harness/udpstream/bench-sweep.sh
old mode 100644
new mode 100755
diff --git a/harness/udpstream/build-lance.sh b/harness/udpstream/build-lance.sh
index 63f7f92..3d6a052 100755
--- a/harness/udpstream/build-lance.sh
+++ b/harness/udpstream/build-lance.sh
@@ -43,7 +43,7 @@ cp "$DIR/vram.asm" "$WORK/VRAM.ASM"
     printf '%s\n' 'MEMORY'
     printf '%s\n' '{'
     printf '%s\n' "  prog: origin = ${TEXT}h, length = 20000h"
-    printf '%s\n' "  ram:  origin = ${BSS}h,  length = 40000h"
+    printf '%s\n' "  ram:  origin = ${BSS}h,  length = 200000h"
     printf '%s\n' '}'
     printf '%s\n' 'SECTIONS'
     printf '%s\n' '{'
diff --git a/harness/udpstream/build/lance_cmd.coff b/harness/udpstream/build/lance_cmd.coff
index 7e2dcd1..4eb30a0 100644
Binary files a/harness/udpstream/build/lance_cmd.coff and b/harness/udpstream/build/lance_cmd.coff differ
diff --git a/harness/udpstream/vram.asm b/harness/udpstream/vram.asm
index 5abdb38..fb57c66 100644
--- a/harness/udpstream/vram.asm
+++ b/harness/udpstream/vram.asm
@@ -56,4 +56,57 @@ _vram_fill_:
 	move	*sp+, b2, 1
 	rets
 
+; vram_blit_ -- copy a 1-bpp rectangle from RAM to VRAM with PIXBLT L,XY.
+; The manual has no L,L variant; the destination is XY so the hardware forms
+; the address from OFFSET + y*CONVDP + x (rom:07ee9db6 does the same with
+; MOVI 0x4000000,B4).
+;
+;   _blit_src    linear source address (bit address, 1 bpp, SPTCH apart)
+;   _blit_sptch  source pitch in bits; 0 makes every row read the same address
+;   _blit_daddr  destination XY: (y << 16) | x
+;   _blit_dydx   dimensions XY: (rows << 16) | columns
+	.globl	_vram_blit_
+	.ref	_blit_src
+	.ref	_blit_sptch
+	.ref	_blit_daddr
+	.ref	_blit_dydx
+_vram_blit_:
+	setf	32, 0, 1
+	move	b0, -*sp, 1
+	move	b1, -*sp, 1
+	move	b2, -*sp, 1
+	move	b3, -*sp, 1
+	move	b4, -*sp, 1
+	move	b7, -*sp, 1
+
+	move	@_blit_src, b0, 1	; SADDR
+	move	@_blit_sptch, b1, 1	; SPTCH
+	move	@_blit_daddr, b2, 1	; DADDR (XY)
+	movi	800h, b3		; DPTCH = 256 bytes
+	movi	04000000h, b4		; OFFSET = VRAM base
+	move	@_blit_dydx, b7, 1	; DYDX (rows, columns)
+
+	movi	1, a1
+	move	a1, @0C0000150h, 0	; PSIZE = 1
+	movi	14h, a1
+	move	a1, @0C0000130h, 0	; CONVSP = pitch code for 0x800 bits
+	move	a1, @0C0000140h, 0	; CONVDP
+	clr	a1
+	move	a1, @0C0000160h, 0	; PMASK = 0
+	move	a1, @0C0000170h, 0
+	move	@0C00000B0h, a1, 0	; CONTROL: keep CD/RM/RR, raster op = 0
+	andi	0801Fh, a1
+	move	a1, @0C00000B0h, 0
+	move	@0C00000B0h, a1, 0	; read back (pipelined I/O)
+
+	pixblt	l, xy
+
+	move	*sp+, b7, 1
+	move	*sp+, b4, 1
+	move	*sp+, b3, 1
+	move	*sp+, b2, 1
+	move	*sp+, b1, 1
+	move	*sp+, b0, 1
+	rets
+
 	.end