forked from arti/vt1200
SDD
03e6a88b22
Call site (not a register snapshot): 3FA84FB0 calla L3FA6E4B0; 3FA84FE0 stores a8; 3FA85000 move a8,a8 / 3FA85010 jreq; the nonzero path ends at 3FA85360-3FA853A0 with a11 = 0x400 returned. Live breakpoint confirms code=0x400 enters the HOST PORT handler 3FDE9D70. So the quantity to zero is L3FA6E4B0's return value (all five descriptor fields zero). Polarity resolved: L3FA71BC0/L3FA753D0 return their 32-bit flag word, which is 0 iff all their checks pass, so L3FA6E4B0's bits are failure bits. My earlier "L3FA753D0 returns 0x408 while its checks pass" was a misread -- the same 32-bit word also carries the setf-4/setf-2 fields at a13(0xc4/c8/ca/cc). The checks are therefore the right quantity. Loopback-clock deviation (SCN2681 p.12 item 2): real but NOT the cause. CSRA=0x88 gives TX==RX==2400 baud, so the clock source changes only the sampling phase, not the bit count or the completion time; and the received bytes are already correct, so MAME samples the TX bit centres. Not changed (would be banking a green). Measured residual: a ~1-bit write->receive offset (completion at W+1.07 char vs a 1.00-char write interval), sourced from the ~1 bit between a THRA write and the first transmitted bit; forcing it to zero corrupted the sampling phase, so the half-bit TX offset is load-bearing. Model vs datasheet items 3/4/5: matches (loopback fills the FIFO with the receiver disabled, which is what CRA=5 then CRA=0xA relies on). Regression holds.