harness: identify the level-1 video-memory test that raises code 0x100 (VIDEO MEMORY-22)

The dispatch status is 0x100 (printed as '22' in the message). A driver-side
transparent low-RAM write log (VT1200_LOWLOG) shows the slot at bit 0x16F0 is
written by the store at 3FDF9090 from a13(0x10), which L3FA7C050 sets to the
literal 0x100 when the memory test L3F2018B0 returns non-zero. L3F2018B0 is the
level-1 video-memory test (base bit 0x04000000, count 0x20000). Its failing
checks: the 16-bit walking-bit read-back at 0x04000000 (baseline, unmapped) and,
with video RAM mapped, the REFCNT (0xC00001F0) 'must change' check.

harness/mame/code22_walk.lua

@@ -0,0 +1,43 @@
+-- code22_walk.lua
+--
+-- Breaks at the level-1 error dispatcher read (bit 0x3FDF0630) and dumps:
+--   * registers sp / a13 / a14 / a8 / a9
+--   * the word the dispatcher reads:  *a13(0xffe0)  = memory at (a13 - 0x20)
+--   * a window of low RAM around the alleged slot a13-0x20
+--   * the whole task stack, sp .. 0x5400, one line per word
+--
+-- All memory addresses in the debugger are BIT addresses; a word is 0x10
+-- bits apart.  Only plain (unparenthesised) expressions are used: a
+-- `d@(sp+20h)` action silently breaks bpset.
+--
+--   CW_FRAMES=300 <mame> vt1200 ... -debug -debugger none \
+--       -autoboot_script harness/mame/code22_walk.lua
+
+local machine = manager.machine
+local cpu = machine.devices[':maincpu']
+local dbg = machine.debugger
+if not dbg then print("ERROR: no debugger"); machine:exit(); return end
+
+local act = "{ "
+	.. 'printf "DISP sp=%08X a13=%08X a14=%08X a8=%08X a9=%08X a11=%08X\\n", sp, a13, a14, a8, a9, a11 ; '
+	.. 'printf "SLOT d@16E0=%04X d@16F0=%04X d@1700=%04X d@1710=%04X d@1720=%04X d@1730=%04X\\n", d@16E0, d@16F0, d@1700, d@1710, d@1720, d@1730 ; '
+	.. 'printf "S00 %04X %04X %04X %04X %04X %04X %04X %04X\\n", d@5280, d@5290, d@52A0, d@52B0, d@52C0, d@52D0, d@52E0, d@52F0 ; '
+	.. 'printf "S01 %04X %04X %04X %04X %04X %04X %04X %04X\\n", d@5300, d@5310, d@5320, d@5330, d@5340, d@5350, d@5360, d@5370 ; '
+	.. 'printf "S02 %04X %04X %04X %04X %04X %04X %04X %04X\\n", d@5380, d@5390, d@53A0, d@53B0, d@53C0, d@53D0, d@53E0, d@53F0 ; '
+	.. 'g }'
+
+dbg:command("bpset 3fdf0630,," .. act)
+print("breakpoint armed at 3fdf0630")
+
+local maxframes = tonumber(os.getenv("CW_FRAMES") or "300")
+local n = 0
+emu.register_frame_done(function()
+	n = n + 1
+	if n >= maxframes then
+		print("done (" .. n .. " frames)")
+		machine:exit()
+	end
+end, "vt1200-cw")
+
+dbg.visible_cpu = cpu
+dbg.execution_state = 'run'