diff --git a/harness/mame/NETWORK_REPORT.md b/harness/mame/NETWORK_REPORT.md
index 3dda0e9..2e2bd31 100644
--- a/harness/mame/NETWORK_REPORT.md
+++ b/harness/mame/NETWORK_REPORT.md
@@ -5021,3 +5021,20 @@ filled 300 frame(s) x 1024 rows (FILL L): 24576000 stores in 9.775 s
 9.8 s of full-screen black/white flash at ~31 fps — the operator's own
 description was "damn that's fast". It also shows the number is sustained, not a
 one-frame burst.
+
+### 74.5 A failed measurement that cost a power cycle
+
+`cmd 9` first wrote its 163,840 bytes to a hardcoded address, `0x01A10000`
+(bits) — chosen by arithmetic: above MARK (`0x01A00000`) and below `.bss`
+(`0x01C00000`). On the unit that address did **not** behave as RAM: the
+benchmark produced no reply within 120 s, and the machine stopped answering
+ping and rdebug, so it needed a power cycle.
+
+The lesson is the one this project keeps relearning in different clothes: an
+address that is inside a mapped region in the emulator is not evidence that it
+is usable on the board. The benchmark now writes into `static unsigned char
+drambuf[512]` — memory the linker places inside `.bss`, which the payload
+already depends on for every string and label it draws.
+
+Only the *target* changed; the loop and its store count are the same, so the
+per-store cost is still what the benchmark reports.
diff --git a/harness/udpstream/build/lance_cmd.coff b/harness/udpstream/build/lance_cmd.coff
index c88d29f..5599b99 100644
Binary files a/harness/udpstream/build/lance_cmd.coff and b/harness/udpstream/build/lance_cmd.coff differ
diff --git a/harness/udpstream/lance_cmd.c b/harness/udpstream/lance_cmd.c
index 1fd5201..b309d23 100644
--- a/harness/udpstream/lance_cmd.c
+++ b/harness/udpstream/lance_cmd.c
@@ -64,6 +64,10 @@
 /* read by vram.asm (symbol _vram_pattern) */
 unsigned int vram_pattern;
 
+/* DRAM store benchmark target: 512 bytes is enough to measure the per-store
+ * cost, and the linker guarantees it is memory we own. */
+static unsigned char drambuf[512];
+
 extern void vram_fill_();
 
 /* Compile-time guard: the RX ring must end before the TX ring starts.
@@ -510,6 +514,10 @@ int main()
                      * CPU's store rate is measured without the VRAM arbiter.
                      * This is the number that sizes a frame-expansion stage. */
                     unsigned int nd, fd, yd, xd, od, rd, st;
+                    /* write into a linker-placed .bss buffer: an arbitrary DRAM
+                     * address outside .bss made the unit hang for >120 s, which
+                     * means it was not RAM we own */
+                    unsigned char *db = drambuf;
                     nd = rlen;
                     if (nd > 100) {
                         nd = 100;
@@ -521,7 +529,7 @@ int main()
                     st = 0;
                     for (fd = 0; fd < nd; fd++) {
                         for (yd = 0; yd < rd; yd++) {
-                            od = 0x01A10000 + yd * 2048;
+                            od = (unsigned int)db;
                             for (xd = 0; xd < 160; xd++) {
                                 *(unsigned char *)(od + xd * 8) =
                                     (unsigned char)(yd + xd + fd);