I don't know exactly how they function, but my understanding is that one of them is a breakpoint address (i.e. when that address is accessed, the CPU jumps to the AR hook routine) and the other is an address for the AR to use as work RAM (to store e.g. the list of active codes and maybe even the patch routine itself). IIRC, the standard "work RAM" address is the place where the BIOS temporarily loads the disc header, which is sort of a gap between the standard exception vector locations and the standard start address for Saturn programs. I'm not sure what the standard breakpoint address represents, but it's most likely some status variable from SGL or SBL that is accessed regularly (e.g. an "are we currently in vsync" variable).
