I was probing around the Genesis and checked out some of the signals (all while /CART is grounded). Address ranges that make the system lock up (no DTACK) weren't included. Cartridge port: /ASEL is asserted for reads and writes within 000000-7FFFFF /CAS_2 is asserted for reads and writes within 000000-7FFFFF /CE_0 is asserted for reads and writes within 000000-3FFFFF /CAS_0 is asserted for reads *only* within 000000-7FFFFF /TIME is asserted for reads and writes within A13000-A130FF Timing-wise, pulses on /CAS_0, /CE_0, /AS are identical, pulses on /ASEL and /DTACK are identical but longer, /CAS_2 was the longest. Other signals (68K work RAM): /RAS_2 is asserted for reads and writes within E00000-FFFFFF The schematics show /RAS_2 on the expansion connector; I haven't tested it but a multimeter check on the console I was using showed that /RAS_2 on the expansion port was not related to the work RAM /CS pins, which are connected to '/RAS_2' in the schematic. Expansion port: /FDWR is asserted for writes only within A12000-A120FF /DISK is asserted for reads and writes within A12000-A120FF /FDC is asserted for reads and writes within A12000-A120FF /ROM is asserted for reads and writes within 400000-5FFFFF Not sure what's with all the duplication of the floppy disk related signals. I don't know which one(s) the Sega CD uses to map it's registers to the $A120xx range. Probably /ROM changes to 000000-1FFFFF (or 3FFFFF as the high range?) when /CART is high for use by the Sega CD's BIOS ROM. When A11200=$0100 (DRAM enabled), there is an extra pulse on /CE_0 about every 200 EDCLKs. This same pulse also appears on /CAS_2 regardless of A11200, both occur at the same time. Likewise, about every 222 EDCLKs there is something like a /DTACK delay where all signals (/CAS_0, /CE_0, /DTACK, /ASEL, /CAS_2) are stretched out for 2 or 3 68000 clocks. This occurs when running out of ROM or RAM. I checked /BR to see if the VDP was taking over the bus for DMA, but it isn't. Not sure what that's all about.