udpstream: DRAM benchmark writes to a .bss buffer, not a guessed address

cmd 9's first version wrote to 0x01A10000 (bits), chosen as "above MARK, below
.bss".  On the unit that was not usable RAM: no reply in 120 s and the machine
stopped answering ping and rdebug -- one power cycle.

The target is now `static unsigned char drambuf[512]`, placed by the linker
inside .bss, which the payload already relies on for its labels and strings.
Loop and store count are unchanged, so the per-store figure stays comparable.

Report 74.5 records it.

harness/mame/NETWORK_REPORT.md

@@ -5021,3 +5021,20 @@ filled 300 frame(s) x 1024 rows (FILL L): 24576000 stores in 9.775 s
 9.8 s of full-screen black/white flash at ~31 fps — the operator's own
 description was "damn that's fast". It also shows the number is sustained, not a
 one-frame burst.
+
+### 74.5 A failed measurement that cost a power cycle
+
+`cmd 9` first wrote its 163,840 bytes to a hardcoded address, `0x01A10000`
+(bits) — chosen by arithmetic: above MARK (`0x01A00000`) and below `.bss`
+(`0x01C00000`). On the unit that address did **not** behave as RAM: the
+benchmark produced no reply within 120 s, and the machine stopped answering
+ping and rdebug, so it needed a power cycle.
+
+The lesson is the one this project keeps relearning in different clothes: an
+address that is inside a mapped region in the emulator is not evidence that it
+is usable on the board. The benchmark now writes into `static unsigned char
+drambuf[512]` — memory the linker places inside `.bss`, which the payload
+already depends on for every string and label it draws.
+
+Only the *target* changed; the loop and its store count are the same, so the
+per-store cost is still what the benchmark reports.

harness/udpstream/lance_cmd.c

@@ -64,6 +64,10 @@
 /* read by vram.asm (symbol _vram_pattern) */
 unsigned int vram_pattern;
 
+/* DRAM store benchmark target: 512 bytes is enough to measure the per-store
+ * cost, and the linker guarantees it is memory we own. */
+static unsigned char drambuf[512];
+
 extern void vram_fill_();
 
 /* Compile-time guard: the RX ring must end before the TX ring starts.
@@ -510,6 +514,10 @@ int main()
                      * CPU's store rate is measured without the VRAM arbiter.
                      * This is the number that sizes a frame-expansion stage. */
                     unsigned int nd, fd, yd, xd, od, rd, st;
+                    /* write into a linker-placed .bss buffer: an arbitrary DRAM
+                     * address outside .bss made the unit hang for >120 s, which
+                     * means it was not RAM we own */
+                    unsigned char *db = drambuf;
                     nd = rlen;
                     if (nd > 100) {
                         nd = 100;
@@ -521,7 +529,7 @@ int main()
                     st = 0;
                     for (fd = 0; fd < nd; fd++) {
                         for (yd = 0; yd < rd; yd++) {
-                            od = 0x01A10000 + yd * 2048;
+                            od = (unsigned int)db;
                             for (xd = 0; xd < 160; xd++) {
                                 *(unsigned char *)(od + xd * 8) =
                                     (unsigned char)(yd + xd + fd);