Pokemon Gold: Invalid data written to VRAM

[aksiksi]

Right after the player first appears, some tiles get invalid tile attributes written to bank 1 of VRAM. The data should have been written to bank 0. For some reason, these invalid writes to the tile map area only occur for 3 lines worth of tiles. Also, the failure is intermittent, even for the same save state.

In BGB, writing to the tilemap takes place in this function:

0x20E6: ld de, 0xC3A0
...
0x20F5: ld (0xFF4F), a ; VRAM bank 1
...
0x2101: ldi (hl), a ; write to tilemap
...
0x210F: ld (0xFF4F), a ; VRAM bank 0
...
0x2111: ret

The callstack to get here is:

??: rst 08
0x0008: jp 0x2E27
0x2E27: ld (0xD156), a
...
0x2E31: call 0x2E48
0x2E48: jp (HL) ; passed in prior to rst
??: call 20C3
0x20C3: call 20E6

[aksiksi]

Refer to disassembly here: https://github.com/pret/pokegold