fix crash: marker block overlapped .text after the text panel grew it

.text went from 0x018C6140 to 0x018CACD0, so the marker cells at 0x018C8000
landed inside the payload's own code; cell() then overwrote instructions and
the CPU faulted with an illegal opcode before drawing anything.

MARK moved to 0x018D0000 (~2.6 KB past the end of .text).

harness/mame/NETWORK_REPORT.md

@@ -4267,3 +4267,17 @@ Consequences, all now fixed:
 The restore path in `harness/udpstream/lance.c` now re-programs the chip with
 `0x7F41` (the firmware's own init value: `INIT | INEA | all status bits`), polls
 `IDON`, writes `0x0042`, and leaves the driver's cells untouched.
+
+## 63. Crash cause: the marker cells ran into `.text`
+
+Adding the text panel grew `.text` from `0x018C6140` to `0x018CACD0`, which
+**swallows the marker block** at `0x018C8000`. The payload then wrote
+`cell(0x160, …)` and friends straight into its own code, and the CPU executed
+the overwritten bytes — an illegal opcode before any text was drawn (four
+progress dots, blank panel).
+
+That is a general hazard of this payload layout: `.text` grows upward from
+`0x018C0000` while the markers were hard-coded at `0x018C8000`. They are now at
+**`0x018D0000`**, clear of the end of `.text` by ~2.6 KB.
+
+Any future growth should re-check `build/lance.map` against `MARK`.

harness/udpstream/lance.c

@@ -20,7 +20,7 @@
  */
 #define RAP        0x05900000
 #define RDP        0x05800000
-#define MARK       0x018C8000
+#define MARK       0x018D0000   /* after .text (which now reaches 0x018CACD0) */
 #define VRAM_BASE  0x04000000
 
 #define MODE_LOOP  0x0004

harness/udpstream/lance_fixlen.c

@@ -20,7 +20,7 @@
  */
 #define RAP        0x05900000
 #define RDP        0x05800000
-#define MARK       0x018C8000
+#define MARK       0x018D0000   /* after .text (which now reaches 0x018CACD0) */
 #define VRAM_BASE  0x04000000
 
 #define MODE_LOOP  0x0004