Ok, here's a summary of what I saw:
• RGB PPU sprite tests
→ (Of course, sprites work). Writes to $2003 appear to not cause OAM corruption. Bizarrely.
→ Followup question: Does this change from revision to revision of the 2C02 ? When did they break it? Maybe kevtris would be willing to test... Or is this an artifact of the 2A03's timing changing instead?
• RGB PPU memory readability
→ Neither palette memory nor OAM is readable.
→ I forgot to check whether the value read from $2004 is the normal "PPU's internal open bus" value, i.e. what you'd also read from any of the write-only registers.
• RGB PPU overscan
→ Overscan does appear to be the color of the backdrop. Like the 2C02, the top and bottom appear to have 0 and 2 scanlines respectively of backdrop color, so It's probably the same 284x242 picture that the 2C02 draws. Any more specific horizontal timing will require a 'scope.
• 108 banking verification
→ N108 banks 0-7 are mapped to the PRG2 socket, and are open-bus if that socket isn't populated.
• 108 0x8000 execution bug
→ I was unable to reproduce Naruko's bug. This might be because the 108 on the RBI daughterboard uses /A15 instead of /ROMSEL. I may have to pick up some random Tengen game from the local used game store to try to reproduce this one.
• 127 reader
→ A11 (as surmised) is ignored. Reads from addresses 0x5e00, 0x5801, 0x5901, 0x5a01, 0x5b01, 0x5c01, 0x5d01, and 0x5f01 appear to be open-bus.
→ Could you run this test again and play with both sticks? The UI should be:
Left (P1) stick: up/down change address by 0x10; left/right change address by 0x100
Right (P2) stick: up/down change address by 0x01
→ There is a minor bug such that certain addresses could accidentally leave the coin counter in the "driven" state, and getting hot. (These would be addresses 0x5e20 through 0x5e3f, and any others where the second-to-last digit is 2,3,6,7,a,b,e,f)
Those 384 bytes worth of data should be enough to figure out what the IC is doing inside. It feels like an LFSR, but... also, transcribing that for analysis is going to be a pain. (Oh well)
... Actually, now that we know the approximate shape of the 127's results, I should add a new test that will just scan for not-open bus locations and report any place it differs.