diff --git a/harness/mame/NETWORK_REPORT.md b/harness/mame/NETWORK_REPORT.md
index 758a8a4..fca5f9a 100644
--- a/harness/mame/NETWORK_REPORT.md
+++ b/harness/mame/NETWORK_REPORT.md
@@ -4267,3 +4267,17 @@ Consequences, all now fixed:
 The restore path in `harness/udpstream/lance.c` now re-programs the chip with
 `0x7F41` (the firmware's own init value: `INIT | INEA | all status bits`), polls
 `IDON`, writes `0x0042`, and leaves the driver's cells untouched.
+
+## 63. Crash cause: the marker cells ran into `.text`
+
+Adding the text panel grew `.text` from `0x018C6140` to `0x018CACD0`, which
+**swallows the marker block** at `0x018C8000`. The payload then wrote
+`cell(0x160, …)` and friends straight into its own code, and the CPU executed
+the overwritten bytes — an illegal opcode before any text was drawn (four
+progress dots, blank panel).
+
+That is a general hazard of this payload layout: `.text` grows upward from
+`0x018C0000` while the markers were hard-coded at `0x018C8000`. They are now at
+**`0x018D0000`**, clear of the end of `.text` by ~2.6 KB.
+
+Any future growth should re-check `build/lance.map` against `MARK`.
diff --git a/harness/udpstream/build/lance.coff b/harness/udpstream/build/lance.coff
index 68c2be2..5421f5c 100644
Binary files a/harness/udpstream/build/lance.coff and b/harness/udpstream/build/lance.coff differ
diff --git a/harness/udpstream/build/lance_fixlen.coff b/harness/udpstream/build/lance_fixlen.coff
index 1daaa6d..e7bb6c2 100644
Binary files a/harness/udpstream/build/lance_fixlen.coff and b/harness/udpstream/build/lance_fixlen.coff differ
diff --git a/harness/udpstream/lance.c b/harness/udpstream/lance.c
index d8d97db..50b4d66 100644
--- a/harness/udpstream/lance.c
+++ b/harness/udpstream/lance.c
@@ -20,7 +20,7 @@
  */
 #define RAP        0x05900000
 #define RDP        0x05800000
-#define MARK       0x018C8000
+#define MARK       0x018D0000   /* after .text (which now reaches 0x018CACD0) */
 #define VRAM_BASE  0x04000000
 
 #define MODE_LOOP  0x0004
diff --git a/harness/udpstream/lance_fixlen.c b/harness/udpstream/lance_fixlen.c
index 678533c..00514b5 100644
--- a/harness/udpstream/lance_fixlen.c
+++ b/harness/udpstream/lance_fixlen.c
@@ -20,7 +20,7 @@
  */
 #define RAP        0x05900000
 #define RDP        0x05800000
-#define MARK       0x018C8000
+#define MARK       0x018D0000   /* after .text (which now reaches 0x018CACD0) */
 #define VRAM_BASE  0x04000000
 
 #define MODE_LOOP  0x0004