I had a playthrough of TF2 and TF3 without incident, but TF4 was still having problems. I found two specific spots that locked up, and was able to save state them to track things down. Eventually, I found a second checksum routine at $781E, which was triggering after the power up animation where you get the enhanced CLAW.

It's pretty much the same as the first one:

 lea $80.w, A0 moveq #$0,d0 adda.l a0,a0 adda.l a0,a0		<--- $200 move.w #$2b80,d7	<--- to $AFFF subq.w #1,d7782e: add.l (a0)+,d0 dbra d7,$782e cmp.l $bff8.l,d0  <-- d3fbb88a -- mine is c3eeb886 bne $5aa6 bra $2ece

I set extra breakpoints and played through the end. The original checksum code at $5CAE was called in ten different places, and this new function was called after every white screen wipe.

So, had to change this extra checksum, and again the main cartridge checksum:

BFF8 - change "D3FB B88A" to "C3EE B886"

018E - update to "08F5"

And just for the heck of it - here are the patches for all three games. I think they are probably working now!

TFPatches.zip

(You'll need an IPS patch tool and the original ROMs to use these.)