I've been doing some research into ANTIC's unstopped playfield DMA bug, and I have a question about the logic not covered by the schematic: are the addresses fully decoded for all of the line buffer RAM cells?
Yes, internal RAM address is always fully decoded. Each RAM row (one byte) is selected by a single address only. As implied (but you are right, not explicitely enough) by the schematics, each row is selected by a wide NOR that is activated by a single and unique combination of the address signals.
The test app is showing a solid band of color in the middle that indicates the 6-bit address LFSR is cycling through a full 63 address sequence...
Yes, the LFSR logic has a full 63 stages sequence. Under "normal" ANTIC operation, the LFSR is reset at the start of the line, and it would never advance past the 48th stage. Each one of the first 48 stages (after LFSR reset) of the LFSR selects one RAM row, the other 15 stages (there is no stage with all bits zero) don't select any RAM row.
ANTIC, for some reason, attempts to access (read or write) internal RAM at any of the 15 last stages of the LFSR, no actual RAM would be selected.
I admit I was a bit lazy on that part of the schematics. I would need somehow to make this more clear and explicit.