Code:
$87/82F2 BF 88 88 87 LDA $878888,x[$87:88BA] A:0032 X:0032 Y:89F3 D:0000 DB:92 S:1FDF P:envmxdizcHC:1218 VC:000 00 FL:65106
$87/82F6 FA PLX A:83B3 X:0032 Y:89F3 D:0000 DB:92 S:1FDF P:eNvmxdizcHC:1274 VC:000 00 FL:65106
$87/82F7 C8 INY A:83B3 X:0000 Y:89F3 D:0000 DB:92 S:1FE1 P:envmxdiZcHC:1318 VC:000 00 FL:65106
$87/82F8 48 PHA A:83B3 X:0000 Y:89F4 D:0000 DB:92 S:1FE1 P:eNvmxdizcHC:1340 VC:000 00 FL:65106
$87/82F9 60 RTS A:83B3 X:0000 Y:89F4 D:0000 DB:92 S:1FDF P:eNvmxdizcHC:0010 VC:001 00 FL:65106
$87/83B4 B9 00 00 LDA $0000,y[$92:89F4] A:83B3 X:0000 Y:89F4 D:0000 DB:92 S:1FE1 P:eNvmxdizcHC:0060 VC:001 00 FL:65105
$87/82F6 FA PLX A:83B3 X:0032 Y:89F3 D:0000 DB:92 S:1FDF P:eNvmxdizcHC:1274 VC:000 00 FL:65106
$87/82F7 C8 INY A:83B3 X:0000 Y:89F3 D:0000 DB:92 S:1FE1 P:envmxdiZcHC:1318 VC:000 00 FL:65106
$87/82F8 48 PHA A:83B3 X:0000 Y:89F4 D:0000 DB:92 S:1FE1 P:eNvmxdizcHC:1340 VC:000 00 FL:65106
$87/82F9 60 RTS A:83B3 X:0000 Y:89F4 D:0000 DB:92 S:1FDF P:eNvmxdizcHC:0010 VC:001 00 FL:65106
$87/83B4 B9 00 00 LDA $0000,y[$92:89F4] A:83B3 X:0000 Y:89F4 D:0000 DB:92 S:1FE1 P:eNvmxdizcHC:0060 VC:001 00 FL:65105
My understanding here is that the 16-bit value that's loaded from $8788BA ($83B3) is being pushed on the stack to be used as the return address. That I follow perfectly, but when the RTS at $8782F9 is hit, instead of returning to $8783B3 like I thought it would, it returns to $8783B4. What the hell? :huh:
I checked the stack and the data at $8788BA and in both places it's $83B3, not $83B4. Just to clarify, I have not modified ANYTHING in this ROM. The thing that's really baffling is that there is an RTS at $8783B3, but if that were being executed the stack pointer should reflect that, which, as you can see above, it doesn't.

Anyone have any ideas? Or some esoteric knowledge to share that might be of use?