If I drop the whole "hard-wired" outer bank theory in favor of the last 48K of each 128K PRG ROM portion just having being copied into each bank during assembly of the ROM images for production, then the whole thing becomes much simpler.
Code:
8010+x bits
00 0000
05 0101
0A 1010
0F 1111
||||
|||+-------- PRG A17
||+--------- PRG A18
|+---------- CHR A17
+----------- CHR A18
A00..A14 CPU (0000-7FFF)
A13..A16 MMC3 (8K 00-0F, A17/A18 unconnected?)
A17..A18 latch (128K 00-03)
A00..A12 PPU (0000-1FFF)
A10..A16 MMC3 (1K 00-7F, A17 unconnected?)
A17..A18 latch (128K 00-03)
Which would simply give 512 KiB PRG and CHR ROM. I'm probably getting a few details wrong, but you get the idea.
lidnariq wrote:
Another simpler possibility is that for some inscrutable reason, the CHR ROM literally contains a copy of some of the data from the PRG ROM.
The PRG data at the end each 128K CHR ROM bank might be due to a buffer used by some ROM preparation program that, for each 128 KiB bank, was filled with user data. The same buffer may have been used for preparing CHR ROM bank data after it had been used for preparing PRG ROM bank data, and since the CHR ROM bank data did not fully fill up the buffer, whatever was left in the buffer from previous banks just got burnt into the ROM? Kind of like MS-DOS directory data ended up in the Beauty and the Beast NES ROM image.