OK, just a quick update on the sound and SP Football diversions before I crash out for a few hours:
I looked at what Space Spartans does to get the "gritty" explosion. It programs $0000 into the pitch period for channel A, while putting noise on channel C. It fades that out with an envelope. On the original AY-3-8914, $0000 is the maximum period pitch. But, if you look at the MAME source, they say on the AY-3-8910 a period of $0000 is the minimum pitch period (and would be fairly inaudible). That suggests to me that the "thinness" on those explosions results not from a timing difference in the EXEC, but rather a difference in how the counters are managed inside the PSG chip itself. The MAME documentation also mentions the count-up-and-compare method (which also matches the proposed AY-3-8914 changes seen on PapaIntellivision), again suggesting this was an AY-3-8914 => AY-3-8914A change that also made it into the AY-3-8910.
That's not to say there aren't EXEC timing differences also at play on some sounds, but for the Space Spartans explosion sound, it looks like I found the smoking gun.
As for SP Football, it's really weird. (And it feels like deja vu typing this, as I think I looked at this once before many moons ago.) The crash happens when a piece of code sets the stack pointer to $200, does a GRAM reinit, and then clears BACKTAB (which is also at $200). The BACKTAB clear wipes the return address, and wackiness ensues. The really weird thing is that that code only runs on the Intellivision 2, and not because a timing change. Rather, the code looks at a single location in the EXEC that differs between the Sears, Inty 1, and Inty 2, and only runs this crashing code on the Inty 2.
Some notes I typed up earlier in a PM, edited slightly: This code sequence is the culprit. The first bit sets the stack pointer to the start of BACKTAB, and things go pear shaped a few moments later:
$A6A1: 02BE 0200 MVII #$0200,R6 ; Set SP to start of BACKTAB
$A6A3: 0004 001E 0335 JSRD R4,$1F35 ; GRAM reinitialization?
$A6A6: 02B8 00F0 MVII #$00F0,R0 ; \
$A6A8: 02BC 0200 MVII #$0200,R4 ; |- Clear BACKTAB to all zeros
$A6AA: 0004 0114 0338 JSR R5,$1738 ; /
The crash results when returning from clearing BACKTAB. The stack pointer still points into BACKTAB. On calling the clear function (JSR R5, $1738), it pushes the return address on the stack (which is in BACKTAB). Then it wipes all of BACKTAB to $0000 (which also wipes the return address). On returning from the function, it pops $0000 off the stack, and *BLAMO*.
The CPU jumps to address $0000 and starts executing code from MOB 0's register space:
0000 0000 3060 A38E 02F0 0000 0201 1740 -C-Z--i- PULR R7 13295902
0000 0000 3060 A38E 02F0 0000 0200 0000 -C-Z--i- ADDI #$3AFF,R7 13295914
0000 0000 3060 A38E 02F0 0000 0200 3B01 ------i- MOVR R0,R3 13295923
0000 0000 3060 0000 02F0 0000 0200 3B02 ---Z--i- MOVR R0,R6 13295929
0000 0000 3060 0000 02F0 0000 0000 3B03 ---Z--i- MOVR R1,R4 13295936
0000 0000 3060 0000 0000 0000 0000 3B04 ---Z--i- MOVR R3,R0 13295942
0000 0000 3060 0000 0000 0000 0000 3B05 ---Z--i- MOVR R6,R0 13295948
0000 0000 3060 0000 0000 0000 0000 3B06 ---Z--i- ADDR R4,R0 13295954
0000 0000 3060 0000 0000 0000 0000 3B07 ---Z--i- ADDR R0,R0 13295960
0000 0000 3060 0000 0000 0000 0000 3B08 ---Z--i- HLT 13295966
0000 0000 3060 0000 0000 0000 0000 3B0A ---Z-D-- DIS 13295971
The instructions starting at $A6A1 are never even reached when running with the Intellivision 1 EXEC.
Here's the bizarro thing: It appears purposeful! Leading up to the code that crashes is the following sequence. It reads a very specific location in the EXEC ROM and sees if it's the value $0004. On the Intellivision 1, it's $02BC. On the Sears unit, it's $0200. On the Intelliviison 2, it's $0004.
000F 0000 9EF5 019D A3CB A371 02FD A698 S---I--- SDBD 6944679
000F 0000 9EF5 019D A3CB A371 02FD A699 S---ID-- MVII #$10EF,R1 6944683
000F 10EF 9EF5 019D A3CB A371 02FD A69C S---I-i- MVI@ R1,R1 6944693
000F 0004 9EF5 019D A3CB A371 02FD A69D S---I-i- CMPI #$0004,R1 6944701
000F 0004 9EF5 019D A3CB A371 02FD A69F -C-ZI-i- BNEQ $A6A3 6944709
So, clearly they had something in mind here, but what? Maybe they were working around something else on the Intellivision 2, and thought they had it fixed, but not quite.
Anyway, time for sleep for me, and then to package up the handful of paid orders that haven't gone out yet. You don't want me messing with tape and sharp objects in this state. At least I can't hurt myself with code....
Edited by intvnut, Sat Sep 17, 2016 9:24 AM.