fix(memory): return the Game Pak address pattern beyond the ROM chip

CPU and DMA reads past the supplied image returned Unmapped and stopped the
machine; a second game's boot code reads 0x09fe20f8 past a 16 MiB image. The
Game Pak shares data lines with the low address lines, so where no chip drives
the bus a read returns the halfword address, (A >> 1) & 0xffff, per lane
(GBATEK; mGBA uses the same pattern).

The chip is the image size rounded up to a power of two. Bytes between a
trimmed image's end and that boundary are unknown and stay diagnostic, as do
host reads and instruction fetches. Two truncation fixtures move into that gap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhfHfHEuzv2AUTd6erW1gU

crates/desktop/tests/rom_cli.rs

@@ -404,10 +404,15 @@ fn rtc_selection_is_explicit_and_does_not_modify_the_rom_file() {
     let path = fixture.rom(&rtc_setup());
     let original = fs::read(&path).unwrap();
     // Without the device, the GPIO store is an ordinary ignored ROM write. The read-back
-    // then reaches past this short image, which remains a diagnostic.
+    // lies beyond this short image's chip, so it returns the bus pattern (address / 2).
     let absent = run(&path, "100");
-    assert_eq!(absent.status.code(), Some(1));
-    assert!(stderr(&absent).contains("unmapped memory at 0x080000c8"));
+    assert!(absent.status.success(), "{}", stderr(&absent));
+    assert!(
+        stdout(&absent).contains("r2=0x00000064"),
+        "{}",
+        stdout(&absent)
+    );
+    assert!(!stdout(&absent).contains("RTC selected"));
     let selected = command()
         .arg("--rtc")
         .arg("--rom")

crates/gba-core/src/cpu/thumb_tests.rs

@@ -709,9 +709,11 @@ fn unsupported_thumb_instructions_preserve_registers_flags_and_state() {
 #[test]
 fn thumb_memory_errors_leave_state_unchanged() {
     for instruction in [
-        0x6801, 0x6001, 0x8801, 0x8001, 0x7801, 0x7001, 0x5e81, 0x9801, 0x9001, 0x4801,
+        0x6801, 0x6001, 0x8801, 0x8001, 0x7801, 0x7001, 0x5e81, 0x9801, 0x9001, 0x4802,
     ] {
-        let mut memory = program(&[instruction]);
+        // A 10-byte image in a 16-byte chip: LDR r0,[pc,#8] reads offset 12, an unknown
+        // byte past the trimmed image. Reads beyond the chip return the bus pattern instead.
+        let mut memory = program(&[instruction, 0, 0, 0, 0]);
         let mut cpu = thumb_cpu();
         cpu.flags = flags();
         cpu.registers[1] = 123;

crates/gba-core/src/cpu/transfer_tests.rs

@@ -343,9 +343,10 @@ fn block_load_can_read_rom_and_store_to_rom_is_ignored() {
 
 #[test]
 fn truncated_rom_does_not_partially_load_a_register_list() {
-    let mut memory = program(&[block(0x0080_0000, true, true, 0, 0x6), 11]);
+    // A 12-byte image in a 16-byte chip: the second word is unknown, so it stays diagnostic.
+    let mut memory = program(&[block(0x0080_0000, true, true, 0, 0x6), 0, 11]);
     let mut cpu = Cpu::new(ROM_START);
-    cpu.registers[0] = ROM_START + 4;
+    cpu.registers[0] = ROM_START + 8;
     let before = cpu.registers;
     assert!(matches!(cpu.step(&mut memory), Err(CpuError::Memory(_))));
     assert_eq!(cpu.registers, before);

crates/gba-core/src/memory.rs

@@ -899,6 +899,18 @@ impl Memory {
                 .map(|word| (word >> ((address & 3) * 8)) as u8)
                 .ok_or(MemoryError::Unmapped(address));
         }
+        if matches!(address >> 24, 0x08..=0x0d)
+            && (address & 0x01ff_ffff) as usize >= self.rom.len().next_power_of_two()
+            && !self.cartridge_state().mapped(address)
+            && (self.cpu_access.is_some() || self.timer_step.get().is_some())
+        {
+            // Beyond the power-of-two ROM chip no device drives the Game Pak bus, which
+            // returns the halfword address (A/2, low 16 bits) on each lane. Bytes between a
+            // trimmed image's end and the chip boundary are unknown and stay diagnostic,
+            // as do host reads and instruction fetches.
+            let halfword = ((address & 0x01ff_fffe) >> 1) as u16;
+            return Ok(halfword.to_le_bytes()[(address & 1) as usize]);
+        }
         if matches!(address, 0x0000_4000..=0x01ff_ffff | 0x1000_0000..=0xffff_ffff) {
             if let Some(word) = self.cpu_access.and_then(|access| access.prefetch) {
                 return Ok((word >> ((address & 3) * 8)) as u8);

crates/gba-core/tests/rom_bus.rs

@@ -0,0 +1,84 @@
+//! Original Game Pak ROM reads beyond the supplied image; no game assets.
+use gba_core::{
+    cpu::{Cpu, CpuError},
+    dma::DMA_BASE,
+    machine::{Machine, MachineError, StepKind},
+    memory::{Memory, MemoryError, ROM_START},
+};
+
+fn words(values: &[u32]) -> Vec<u8> {
+    values
+        .iter()
+        .flat_map(|value| value.to_le_bytes())
+        .collect()
+}
+
+/// LDR r0,=address; then `load`; then loop. The image is 16 bytes, a whole chip.
+fn load(address: u32, load: u32) -> Machine {
+    let mut bus = Memory::new(words(&[0xe59f_0004, load, 0xeaff_fffe, address])).unwrap();
+    let mut cpu = Cpu::new(ROM_START);
+    cpu.step(&mut bus).unwrap();
+    Machine::new(cpu, bus)
+}
+
+#[test]
+fn cpu_reads_beyond_the_chip_return_the_halfword_address_in_every_rom_window() {
+    for (address, instruction, expected) in [
+        (0x0800_1234, 0xe590_1000, 0x091b_091a), // LDR: two halfword addresses.
+        (0x09fe_20f8, 0xe1d0_10b0, 0x107c),      // LDRH: past a 16 MiB image.
+        (0x0800_1235, 0xe5d0_1000, 0x09),        // LDRB of the high lane.
+        (0x0a00_1234, 0xe590_1000, 0x091b_091a), // Wait-state 1 window.
+        (0x0c00_1234, 0xe590_1000, 0x091b_091a), // Wait-state 2 window.
+    ] {
+        let mut machine = load(address, instruction);
+        assert_eq!(machine.step().unwrap(), StepKind::Instruction);
+        assert_eq!(machine.cpu().registers()[1], expected, "{address:#010x}");
+    }
+}
+
+#[test]
+fn unknown_bytes_of_a_trimmed_image_stay_diagnostic() {
+    // A 12-byte image occupies a 16-byte chip: offset 12 is unknown, offset 16 is not.
+    for (target, expected) in [
+        (ROM_START + 12, Err(MemoryError::Unmapped(ROM_START + 12))),
+        (ROM_START + 16, Ok(0x0009_0008)),
+    ] {
+        // LDR r0,[pc,#0] (the literal at offset 8); LDR r1,[r0]; literal.
+        let mut bus = Memory::new(words(&[0xe59f_0000, 0xe590_1000, target])).unwrap();
+        let mut cpu = Cpu::new(ROM_START);
+        cpu.step(&mut bus).unwrap();
+        let before = cpu.clone();
+        match expected {
+            Ok(value) => {
+                cpu.step(&mut bus).unwrap();
+                assert_eq!(cpu.registers()[1], value);
+            }
+            Err(error) => {
+                assert_eq!(cpu.step(&mut bus), Err(CpuError::Memory(error)));
+                assert_eq!(cpu, before);
+            }
+        }
+    }
+}
+
+#[test]
+fn host_reads_and_instruction_fetches_beyond_the_chip_stay_strict() {
+    let bus = Memory::new(words(&[0xeaff_fffe])).unwrap();
+    assert_eq!(
+        bus.read16(ROM_START + 4),
+        Err(MemoryError::Unmapped(ROM_START + 4))
+    );
+    let mut machine = Machine::new(Cpu::new(ROM_START + 0x100), bus);
+    assert!(matches!(machine.step(), Err(MachineError::Cpu(_))));
+}
+
+#[test]
+fn dma_reads_beyond_the_chip_return_the_halfword_address() {
+    let mut bus = Memory::new(words(&[0xeaff_fffe])).unwrap();
+    bus.write32(DMA_BASE + 0x24, 0x0800_1234).unwrap(); // DMA3 source
+    bus.write32(DMA_BASE + 0x28, 0x0300_0000).unwrap(); // DMA3 destination
+    bus.write32(DMA_BASE + 0x2c, 0x8400_0001).unwrap(); // One word, immediate
+    let mut machine = Machine::new(Cpu::new(ROM_START), bus);
+    assert_eq!(machine.step().unwrap(), StepKind::Dma { channel: 3 });
+    assert_eq!(machine.memory().read32(0x0300_0000).unwrap(), 0x091b_091a);
+}