harness: identify the level-1 video-memory test that raises code 0x100 (VIDEO MEMORY-22)

The dispatch status is 0x100 (printed as '22' in the message). A driver-side
transparent low-RAM write log (VT1200_LOWLOG) shows the slot at bit 0x16F0 is
written by the store at 3FDF9090 from a13(0x10), which L3FA7C050 sets to the
literal 0x100 when the memory test L3F2018B0 returns non-zero. L3F2018B0 is the
level-1 video-memory test (base bit 0x04000000, count 0x20000). Its failing
checks: the 16-bit walking-bit read-back at 0x04000000 (baseline, unmapped) and,
with video RAM mapped, the REFCNT (0xC00001F0) 'must change' check.

harness/mame/code22_probe.lua

@@ -0,0 +1,32 @@
+-- code22_probe.lua
+--
+-- Resolve two mechanics at the level-1 error dispatcher:
+--   (1) does a bpset fire BEFORE or AFTER its instruction executes?
+--   (2) what 32-bit value does the dispatcher read from *a13(0xffe0)?
+--
+-- We break at 0x3FDF0630 (the read) and at 0x3FDF0650 (the next instruction,
+-- jreq) and print a8 / a13 / the dword at the read address.
+--
+--   CP_FRAMES=300 <mame> vt1200 ... -autoboot_script harness/mame/code22_probe.lua
+
+local machine = manager.machine
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+if not dbg then print("ERROR: no debugger"); machine:exit(); return end
+
+dbg:command('bpset 3fdf0630,,{ printf "AT-READ  pc=%08X a13=%08X a14=%08X a8=%08X d@16F0=%08X\\n", pc, a13, a14, a8, d@16F0 ; g }')
+dbg:command('bpset 3fdf0650,,{ printf "AT-NEXT  pc=%08X a8=%08X d@16F0=%08X\\n", pc, a8, d@16F0 ; g }')
+print("breakpoints armed")
+
+local maxframes = tonumber(os.getenv("CP_FRAMES") or "300")
+local n = 0
+emu.register_frame_done(function()
+	n = n + 1
+	if n >= maxframes then
+		print("done (" .. n .. " frames)")
+		machine:exit()
+	end
+end, "vt1200-cp")
+
+dbg.visible_cpu = cpu
+dbg.execution_state = 'run'