Debugging Pūkè Jīnglíng (the original version of Peek-a-Boo Poker), it seems that $4101 is a XOR mask that is applied to the value written to $4102 afterwards. I noticed that when I set that game to Mapper 136, my previous emulation selected the correct CHR bank when 00 was written to $4101, and the wrong CHR bank when FF was written to $4101, and the code does EOR the bank number in a similar fashion when writing FF to $4101. Attached find another update to Mapper136.cpp that incorporates this change.
With this $4101 behavior emulated, Pūkè Jīnglíng now runs at mapper 136 as well, though it also had CNROM compatibility code (provided that the CNROM emulation did NOT emulate bus conflicts). The game also writes to $4104, but as I understand the board's address mask, that should just be an alias for $4100 (it writes to $4104 in "direct CHR" mode and to $4104 in "CHR increment" mode). The same applies to the initial AVE release of F-15 City War
(overall CRC32 88A6B192), though the address mask before comparison needs to be $E123 rather than $E103 (so that $4120 is NOT an alias for $4100), otherwise the NINA-03 compatibility write will interfere. (That particular ROM is strange --- it reads from $4100 to check if the current register has the correct value, quite similar to the Diébiàn/Wèilái Xiǎozi, but then ignores the result. I wonder if AVE just hacked the NINA-03 compatibility code into the mapper 136-targeted ROM image?)
Can you check whether writing FF to $4101 has a similar effect on the Mapper 36 board?
Edit: I noticed that this $4101-aware emulation of Mapper 136 also covers all games (Xiǎo Mǎlí Nei-Hu version, Mahjong Block Super Mega version) of Mapper 173, including the protection. It seems like FCEUX' mapper 173 emulation is a special case emulation for two games, whereas Mapper 136 as described is the general case, as Diébiàn and Wèilái Xiǎozi do not work under Mapper 173.
Mapper 172 (that silly Horse Racing game)'s protection read is passed as well, but the CHR bank is visibly wrong. Apparently, that game uses bits 4 and 5 instead of bits 0 and 1 for the CHR bank number, and messes up the order a bit. Probably the same IC but connected differently. Lastly, there is also Mapper 132 (Qiwang), which uses bits 0 and 1 for CHR, and bits 2 and 3 for PRG bank. Again, probably just a case of connecting the same IC in a different way.