RAM Addresses and Routines

Page Customization

Display Decimal Addresses

Display Labels

Show Model I ROM Entries

Show Model III ROM Entries

Show NEWDOS/80 (Model I) Entries

Show TRSDOS 2.3 (Model I) Entries

Show TRSDOS 1.3 (Model III) Entries

Note:

This page documents every RAM address referenced by the TRS-80 Model I (12KB, 0000H–2FFFH) and Model III (14KB, 0000H–37FFH) Level II BASIC ROMs. All ROM entries are derived exclusively from verified disassembly analysis. DOS-specific entries (where present) are derived from disassembly of the respective DOS overlays.

Model I ROM vs Model III ROM:

The “Model I ROM” and “Model III ROM” designations indicate that the address is referenced directly by the respective machine’s Level II BASIC ROM code. A DOS running on a given model does NOT make its addresses “Model I ROM” or “Model III ROM” entries — those are tagged separately with their DOS codes (T1, N1, etc.).

73% of all ROM RAM addresses (192 of 263) are completely identical between the two ROMs, down to the exact same ROM reference addresses. The Level II BASIC interpreter core from roughly 0700H–2FFFH is byte-identical between machines.

Model I ROM Specific:

12 addresses: The Expansion Interface registers (FB00H–FC02H, FF04H), the port FFH shadow register at 403DH (10 references), the disk boot sector buffer at 4200H, and the lower workspace addresses (41F8H, 42E8H, 434CH, 4414H) that sit 100H below their Model III equivalents.

Model III ROM Specific:

46 addresses: Dominated by the built-in disk ROM (34 addresses for FDC variables, disk FCBs, directory pointers), plus the three separate Device Control Blocks (41E5H/41EDH/41F5H replacing the Model I’s single DCB), the 409FH run-mode flags (9 refs from the rewritten tokenizer), the 4210H device selector (14 refs replacing the port FFH shadow), and the PCG interface.

DOS Code Key:

N1	NEWDOS/80 v2.0 (Model I)
T1	Model I TRSDOS v2.3
T3	Model III TRSDOS v1.3

Memory-Mapped I/O and ROM Extension Area

Address (Hex/Dec/Label)	Source	Description
3000H-37FFH ↳12288	Model I ROM	Reserved. Unused expansion ROM space on the Model I (3000H-37FFH). The Model I ROM is only 12KB (0000H-2FFFH); this 2KB region is not populated.
3000H ↳12288	Model III ROM	Write 500 baud cassette leader and sync byte. Entry point in the Model III disk/cassette ROM extension (3000H-37FFH).
3003H ↳12291	Model III ROM	Write 1500 baud cassette leader and sync byte.
3006H ↳12294	Model III ROM	Search for 500 baud cassette leader and sync byte.
3009H ↳12297	Model III ROM	Search for 1500 baud cassette leader and sync byte.
300CH ↳12300	Model III ROM	Turn off cassette motor.
300FH ↳12303	Model III ROM	Turn on cassette motor.
3012H ↳12306	Model III ROM	Disk bootstrap routine entry point.
3015H ↳12309	Model III ROM	Power-up/cold-start routine. The Model III boot vector at 0002H jumps here (JP 3015H). This initializes the disk ROM, installs DCBs, and either boots from disk or falls through to BASIC.
3018H ↳12312	Model III ROM	Maskable interrupt handler entry point.
301BH ↳12315	Model III ROM	RS-232-C initialization driver routine.
301EH ↳12318	Model III ROM	RS-232-C input driver routine.
3021H ↳12321	Model III ROM	RS-232-C output driver routine.
3024H ↳12324	Model III ROM	Keyboard driver routine.
3027H ↳12327	Model III ROM	I/O Route driver routine.
302AH ↳12330	Model III ROM	Part of routine to search for cassette leader and sync byte (jumped to from 0229H).
302DH ↳12333	Model III ROM	Part of LIST command (jumped to from 2B91H).
3030H ↳12336	Model III ROM	BASIC TIME$ function routine.
3033H ↳12339	Model III ROM	$DATE routine (date to 8-character buffer pointed to by HL).
3036H ↳12342	Model III ROM	$TIME routine (time to 8-character buffer pointed to by HL).
3039H ↳12345	Model III ROM	Non-maskable interrupt handler entry point.
3042H ↳12354	Model III ROM	$SETCAS routine (prompt user to set cassette baud rate).
37DEH ↳14302	Model I ROM	Communication Status Address (RS-232-C UART status register on the Expansion Interface).
37DFH ↳14303	Model I ROM	Communication Data Address (RS-232-C UART data register on the Expansion Interface).
37E0H ↳14304	Model I ROM	Interrupt Latch Address (Expansion Interface interrupt status register).
37E1H ↳14305 ↳DSEL$	Model I ROM	Disk Drive Select Latch Address. Writing to this location selects the active floppy drive. 01H=Drive :0, 02H=Drive :1, 04H=Drive :2, 08H=Drive :3.
37E4H ↳14308	Model I ROM	Cassette Select Latch Address. 0=Tape Drive #1, 1=Tape Drive #2.
37E8H ↳14312 ↳PRTAD$	Both Model I and III ROM	$PRSTAT: Printer Status Byte / Line Printer Address. Writing a byte sends it to the printer; reading returns printer status. Bit 7=0 if NOT BUSY, Bit 6=0 if NOT OUT OF PAPER, Bit 5=1 if DEVICE SELECTED, Bit 4=1 if NO PRINTER FAULT, Bits 0-3 NOT USED.
37E9H ↳14313	Both Model I and III ROM	$PROUT: Output a Byte to the Printer.
37ECH ↳14316 ↳FDCAD$	Model I ROM	Floppy Disk Controller COMMAND/STATUS register (Expansion Interface). Tested during power-up to determine if an FDC is present. 00H or FFH=No disk controller; 1BH=SEEK; 88H=READ SECTOR; D0H=FORCE INTERRUPT.
37EDH ↳14317	Model I ROM	Disk Track Select register (Expansion Interface FDC).
37EEH ↳14318 ↳FDCAD$+2	Model I ROM	Disk Sector Select register (Expansion Interface FDC).
37EFH ↳14319 ↳FDCAD$+3	Model I ROM	Disk Data register (Expansion Interface FDC). Byte read from or written to disk.
3800H-3BFFH ↳14336 ↳KEYAD$	Both Model I and III ROM	Keyboard Memory / Address Matrix. Memory-mapped from 3800H through 3BFFH. Each address=one row of keyboard scan matrix; reading returns bitmask of pressed keys.
3840H ↳14400 ↳DNAROW	Both Model I and III ROM	Keyboard scan RAM row for the 7th keyboard matrix line (address 3840h), which maps to the key group containing ENTER (bit 0), CLEAR (bit 1), BREAK (bit 2), RIGHT ARROW (bit 3), LINE FEED (bit 4), LEFT ARROW (bit 5), and SPACE (bit 6).
3880H ↳14464 ↳SHFKEY	Both Model I and III ROM	Single byte at 3880h holding the current shift-key state, read directly from the shift-key keyboard row hardware port. Each bit represents a shift key: bit 0 = Left Shift, bit 1 = Right Shift.
3C00H-3FFFH ↳15360 ↳DSPAD$ / CRT	Both Model I and III ROM	Start of the 1024-byte video display RAM at 3C00h–3FFFh, organized as 16 rows × 64 columns. Each byte holds the ASCII character code displayed at that screen position; writing any byte here immediately changes what is shown. The screen is addressed linearly: row 0 is 3C00h–3C3Fh, row 1 is 3C40h–3C7Fh, …, row 15 is 3FC0h–3FFFh. Characters 00h–7Fh display standard ASCII; 80h–FFh display the alternate (graphics) character set.
3C3EH ↳15422 ↳CRT+62	Both Model I and III ROM	Video RAM address for column 62 of row 0.
3C3FH ↳15423 ↳CRT+63	Both Model I and III ROM	Video RAM address 3C3Fh, the rightmost character position (column 63) of the first screen row (3C00h + 63). Used as a cassette activity indicator: the ROM alternates a '*' (2Ah) and a space (20h) at this position during cassette I/O to provide a visible blink showing the cassette is active.
3C40H ↳15424	Model I ROM	Video RAM - start of line 2. Scroll destination in Model I video scroll routine. Model III uses different scroll calculation.

RST Vector Jump Table (4000H-4027H)

Address (Hex/Dec/Label)	Source	Description
4000H ↳16384 ↳DSPAD$+^D1024	Both Model I and III ROM, N1	RST 00H / RST 08H vector target (3 bytes). JP 4000H at 0005H and 0008H. Default: cold start/reset. Also loaded as DE pointer during init. The address immediately past the end of video RAM (3C00h + 1024 = 4000h), used as a sentinel end address.
4003H ↳16387	Both Model I and III ROM	RST 10H vector target (3 bytes). Character output dispatch. JP 4003H at 0010H.
4006H ↳16390	Both Model I and III ROM	RST 18H vector target (3 bytes). Compare HL to DE utility. JP 4006H at 0018H.
4009H ↳16393	Both Model I and III ROM	RST 20H vector target (3 bytes). BASIC next character fetch. JP 4009H at 0020H.
400CH ↳16396	Both Model I and III ROM, T1	RST 28H vector target (3 bytes). BASIC byte comparison utility. JP 400CH at 0028H.

TRSDOS 1.3 SYS0 System Vectors (400CH-4048H)

Address (Hex/Dec/Label)	Source	Description
400CH ↳16396 ↳RST28	Model III ROM, T3	RST 28H vector: JP to SYSLD overlay loader

RST Vector Jump Table (4000H-4027H)

Address (Hex/Dec/Label)	Source	Description
400FH ↳16399	Both Model I and III ROM, T1	RST 30H vector target (3 bytes). Expression evaluator call. JP 400FH at 0030H.

TRSDOS 1.3 SYS0 System Vectors (400CH-4048H)

Address (Hex/Dec/Label)	Source	Description
400FH ↳16399 ↳RST30	Model III ROM, T3	RST 30H vector: JP to DEBUG breakpoint handler

RST Vector Jump Table (4000H-4027H)

Address (Hex/Dec/Label)	Source	Description
4012H ↳16402	Both Model I and III ROM, T1, N1	RST 38H vector target (3 bytes). BASIC Syntax Error handler. JP 4012H at 0038H.
4015H ↳16405 ↳KDCB$ / KDCB	Both Model I and III ROM	Start of the Keyboard Device Control Block (8 bytes at 4015h–401Ch).

TRSDOS 1.3 Error Handler Overlay – SYS4 (4E00H–50E6H)

Address (Hex/Dec/Label)	Source	Description
4015H ↳16405 ↳KDCB	T3	TRSDOS 1.3 SYS4: Keyboard Device Control Block base. SYS4 reloads the keyboard driver address into the vector slot at KDCB+1 (4016H) from GOSAVE (42B1H) after the DO-file flag is cleared, restoring the normal keyboard handler when an error aborts DO-file execution.

RST Vector Jump Table (4000H-4027H)

Address (Hex/Dec/Label)	Source	Description
4016H ↳16406	N1	NEWDOS/80: Store at 4016H - set interrupt handler.
4018H ↳16408 ↳SKROB	Model III ROM	Single byte at 4018h: the shift-key shadow (last-read) image byte, used to detect transitions in the shift-key state. Stores the previous reading of the SHFKEY row (3880h) so the keyboard scan can XOR against it to find which shift bits have changed.
4019H ↳16409 ↳SHFLCK	Model III ROM	Single byte at 4019h: the CAPS LOCK toggle flag. 00h = caps lock off (lower-case letters produced when Shift is held); non-zero = caps lock on (upper-case forced). On the Model III there is no dedicated CAPS LOCK key; instead, pressing Right Shift toggles this flag. This is the only write to SHFLCK in the ROM. POKE 4019h,1 activates caps lock; POKE 4019h,0 deactivates it.
401AH ↳16410 ↳BLKCNT	Model III ROM	Single byte at 401Ah: the cursor blink countdown counter. Counts down on each real-time clock interrupt (30 Hz heartbeat); when it reaches zero it is reloaded to 7 and the cursor blink state (at 401Bh) is toggled.
401CH ↳16412 ↳BLKON	Model III ROM	Single byte at 401Ch: the cursor blink-mode switch. 00h = blink mode enabled (cursor alternates on/off using BLKCNT); non-zero = no-blink mode (cursor is always on if CURCAR is non-zero).
401DH ↳16413 ↳DDCB$	Both Model I and III ROM, N1	Start of the Video Display Device Control Block (8 bytes at 401Dh–4024h).
401EH ↳16414	N1	NEWDOS/80: Store at 401EH.

System Workspace and DOS Linkage (4033H-407DH)

Address (Hex/Dec/Label)	Source	Description
4020H ↳16416	T1, N1, T3	Video RAM cursor / display position used by SYS5 DEBUG monitor for screen output positioning. SYS5 writes the cursor address here before outputting diagnostic text.

RST Vector Jump Table (4000H-4027H)

Address (Hex/Dec/Label)	Source	Description
4022H ↳16418 ↳CURCAR	Model III ROM	Single byte at 4022h: the cursor ON/OFF flag, forming byte DCB+5 of the video display DCB (DDCB$ at 401Dh). 00h = cursor is off (disabled); any non-zero value = cursor is on, and that value is the underscore character (5Fh by default) displayed at the cursor position.
4023H ↳16419 ↳CURCAR+1	Model III ROM	Single byte at 4023h: the cursor character, forming byte DCB+6 of the video display DCB (DDCB$ at 401Dh). Holds the ASCII character code that is written to the screen at the cursor position when the cursor blink is in the 'on' phase. Default value is 5Fh (underscore '_').
4025H ↳16421 ↳PDCB$	Both Model I and III ROM, N1	Start of the Printer Device Control Block (8 bytes at 4025h–402Ch). The driver uses IX = 4025h to access printer DCB fields: device type at IX+0, driver address at IX+1,2, line count at IX+3, lines-per-page at IX+4 (= 66 by default), characters-per-line at IX+5, max print width at IX+6. Every character sent to the printer with LPRINT passes through this DCB.

System Workspace and DOS Linkage (4033H-407DH)

Address (Hex/Dec/Label)	Source	Description
4028H ↳16424	N1	NEWDOS/80: If A overflowed to 00H (was FFH), fetch the current LINES setting from system variable at 4028H into Register A to use as default.
402AH ↳16426	N1	NEWDOS/80: Store Register Pair HL (00WWH) into memory location 402AH, updating a related display parameter in the SYS0 area.
402BH ↳16427	N1	NEWDOS/80: Fetch the current WIDTH setting from system variable at 402BH into Register A.
402DH ↳16429	T1, N1, T3	TRSDOS 2.3 / NEWDOS/80: Warm start / DOS Ready entry point. NEWDOS/80: SYS0 routine at 402DH is the warm start; reached by a conditional JUMP when the Z flag is set (flag pattern 40H). TRSDOS 2.3: equivalent no-error exit point (same as 4400H DOS READY vector).

TRSDOS 1.3 SYS0 System Vectors (400CH-4048H)

Address (Hex/Dec/Label)	Source	Description
402DH ↳16429 ↳SYS1IN	Model III ROM, T3	Normal return-to-DOS entry point (JP to S1RST1 via DO 10,1)

System Workspace and DOS Linkage (4033H-407DH)

Address (Hex/Dec/Label)	Source	Description
4030H ↳16432	T1, N1, T3	Error-already-displayed exit vector (3 bytes). Patched by the TRSDOS DEBUG command: normally contains LD A,A3H (no-op), patched to CALL 400FH (RST 30H) when DEBUG is active.

TRSDOS 1.3 SYS0 System Vectors (400CH-4048H)

Address (Hex/Dec/Label)	Source	Description
4030H ↳16432 ↳ABORT	Model III ROM, T3	Abort operation, re-entry to DOS (DO 20,1)

System Workspace and DOS Linkage (4033H-407DH)

Address (Hex/Dec/Label)	Source	Description
4031H ↳16433	T1	Address operand portion of the patched instruction at 4030H. Set to 400FH (RST 30H vector) by the DEBUG command handler in SYS1.
4033H ↳16435	Model I ROM, T1	DOS command dispatch vector (3 bytes). Conditional JP at 03D1H.
4033H ↳16435	Model III ROM	DOS command dispatch vector (3 bytes). Conditional jump at 0687H.

TRSDOS 1.3 SYS0 System Vectors (400CH-4048H)

Address (Hex/Dec/Label)	Source	Description
4033H ↳16435 ↳ROMCIO	Model III ROM, T3	Continuation of ROM character I/O dispatcher (JP CIO1)

System Workspace and DOS Linkage (4033H-407DH)

Address (Hex/Dec/Label)	Source	Description
4036H ↳16438	Model I ROM, T1, N1	DOS parameter block pointer (3+ bytes). Loaded as HL at 03E3H.
4036H ↳16438 ↳KBROLT	Model III ROM	Start of the 8-byte keyboard last-state shadow buffer (KBROLT spans 4036h–403Dh), mirroring the 8 keyboard-row hardware registers. Each byte holds the last-read state of one keyboard row, used to detect key-up and key-down transitions by XORing against the current hardware read. Corrupting KBROLT causes phantom key-up or key-down transitions in the corresponding row on the next scan.
403DH ↳16445	Model I ROM, T1	Port FFH shadow register (1 byte). 10 references. Model I uses port FFH for cassette motor, video mode, expansion interface control. This shadow tracks current port value. Read at 0221H, 0348H, 04C3H, 04CFH, 04DAH, 04F6H, 0543H; written at 0228H, 04C8H, 04FBH. TRSDOS 2.3: Written and tested by SYS0 disk I/O routines; used as the port FFH drive-select shadow register throughout DOS operation.
403DH ↳16445	Model III ROM	DOS ready flag / disk jump vector (1-3 bytes). Read at 0348H; conditional JP at 35DDH. Only 2 refs on Model III vs 10 on Model I. Model III replaced port FFH shadow with 4210H device selector.
403EH ↳16446	T1, N1	TRSDOS 2.3 / NEWDOS/80: DOS version number byte (1 byte). TRSDOS 2.3 stores its version identifier here during cold boot initialization. NEWDOS/80 similarly uses this location for its version/identity byte. Read by utilities and DOS routines that need to identify the resident DOS version.
4040H ↳16448	Model III ROM	Disk function vector #2 (3 bytes). Conditional JP at 35E9H.
4040H ↳16448	T1, N1	TRSDOS 2.3 / NEWDOS/80: DOS timer ticks counter (1 byte). Incremented by the interrupt service routine on every interrupt tick (approximately 25 Hz). Used by the DOS for time-delay loops and drive-motor timeout tracking.
4041H ↳16449	T1, N1	TRSDOS 2.3 real-time clock: seconds counter (binary, 00H–3BH). Incremented by the timer interrupt handler at 45AFH once per second.
4042H ↳16450	T1	TRSDOS 2.3 real-time clock: minutes counter (binary, 00H–3BH). Incremented when seconds rolls over from 59.
4043H ↳16451	Model III ROM	Disk function vector #3 (3 bytes). Conditional JP at 35EDH.
4043H ↳16451	T1, N1	TRSDOS 2.3 real-time clock: hours counter (binary, 00H–17H). Incremented when minutes rolls over from 59.
4044H ↳16452	T1, N1	TRSDOS 2.3 date: year (binary, 2 digits). Set by the DATE command (SYS6). Displayed as YY by the TRSDOS clock display routine at 4CD2H.
4045H ↳16453	T1	TRSDOS 2.3 date: day of month (binary, 01H–1FH). Set by the DATE command (SYS6).
4046H ↳16454	Model III ROM	Disk function vector #1 (3 bytes). Conditional JP at 35D9H.
4046H ↳16454	T1, N1	TRSDOS 2.3 date: month (binary, 01H–0CH). Set by the DATE command (SYS6). Also referenced by BASIC/CMD as the base of the date word: LD DE,4046H.

TRSDOS 1.3 SYS0 System Vectors (400CH-4048H)

Address (Hex/Dec/Label)	Source	Description
4046H ↳16454	Model III ROM, T3	Real-time clock interrupt vector 2 (JP 3529H in ROM). Handles cursor flash and clock/calendar update.

System Workspace and DOS Linkage (4033H-407DH)

Address (Hex/Dec/Label)	Source	Description
4047H ↳16455	T1	TRSDOS 2.3: high memory limit pointer (2 bytes, little-endian). Initialized to 5200H during cold boot. Marks the top of DOS-resident code; BASIC/CMD uses this as the answer to the `MEMORY SIZE?` question if the user presses `ENTER`.
4049H ↳16457 ↳DOS	Model III ROM, N1	3-byte Non-Maskable Interrupt (NMI) vector in RAM at 4049h–404Bh. Normally contains a JP instruction (C3h at 4049h) followed by a 16-bit destination address at 404Ah–404Bh (DOS+1). The NMI handler at 0066h jumps to (4049h); whatever address is stored at 404Ah–404Bh is the actual NMI service routine. Corrupting (4049h) redirects all NMI events to an arbitrary address.
4049H ↳16457	T1, N1	TRSDOS 2.3: detected RAM top address (2 bytes). Set during cold boot by the RAM detection routine at 4E00H. Holds the highest usable RAM address found. Also read by BASIC/CMD: LD HL,(4049H) to get DOS memory size.
404AH ↳16458 ↳DOS+1	Model III ROM	16-bit destination address word at 404Ah–404Bh, the operand of the JP instruction at 4049h (DOS) forming the NMI vector. Holds the address of the current NMI service routine.
404BH ↳16459	N1	NEWDOS/80: Point Register HL to 404BH, the breakpoint table in the DOS system area. This table holds up to 2 breakpoint entries, each consisting of: address (2 bytes) + original opcode (1 byte).
404CH ↳16460	T1	TRSDOS 2.3: system capability flags (1 byte). Bit 7 = keyboard interrupt handler installed; Bit 6 = disk I/O handler installed. Tested during DOS READY initialization at 4E1FH.
4051H ↳16465	N1	NEWDOS/80: Store Register Pair HL (0000H) into memory location 4051H in the SYS0 area. This appears to be the disk interrupt handler hook, clearing it to disable disk interrupts during memory operations.
4053H ↳16467	N1	NEWDOS/80: GOSUB to disk interrupt handler hook at 4053H. (Patched Code)
4058H ↳16472	N1	NEWDOS/80: Load Register Pair DE with the 16-bit value stored at memory locations 4058H-4059H. This is the current stack pointer for the '+' command stack.
4059H ↳16473	T1	TRSDOS 2.3: disk I/O vector target (2 bytes). Contains the address portion of a JP nnnn instruction; initialized to 4669H (Disk I/O Core). Allows DOS to redirect disk I/O at runtime.
405BH ↳16475	T1	TRSDOS 2.3: character output vector target (2 bytes). Contains the address portion of a JP nnnn instruction; initialized to 4560H (Character Output / RST 18H handler). Allows output redirection.
405DH ↳16477	T1, N1	TRSDOS 2.3 SYS5 DEBUG: command character / address input storage. The A/H command stores the command byte here via the SetAddress routine at 4ECBH. Also used as a scratch byte by several DEBUG display routines.
405EH ↳16478	T1	TRSDOS 2.3 SYS5 DEBUG: single-step mode flag. 00H = normal execution; non-zero = single-step mode active. Written by the S (Step) command at 4E9AH.
4060H ↳16480	T1	TRSDOS 2.3 SYS5 DEBUG: memory modify address pointer (2 bytes). Current address being examined or modified by the M command at 4FDBH.
4062H ↳16482	T1	TRSDOS 2.3 SYS5 DEBUG: breakpoint save area (2 bytes). Holds the original instruction bytes displaced by F7H breakpoint insertions. Restored when the Go command at 4F80H removes breakpoints.
4063H ↳16483	T1, N1	TRSDOS 2.3 SYS5 DEBUG: display address (2 bytes). Current address for the D (Dump) command and scroll commands (;, −). Advanced by 64 bytes by the Scroll Forward command at 4EAEH.
4065H ↳16485	T1	TRSDOS 2.3 SYS5 DEBUG: saved register save area (20 bytes, 4065H–4078H). Contains the user program's Z80 register set at the time DEBUG took control: AF, BC, DE, HL, IX, IY, AF', BC', DE', HL'. Displayed by the Register Dump routine at 4ECFH.
4068H ↳16488	N1	NEWDOS/80: GOSUB to 4068H to display byte A as 2 hex digits at video position HL.
4071H ↳16497	N1	NEWDOS/80: GOSUB to convert this nibble to ASCII and store it.
4079H ↳16505	T1	TRSDOS 2.3 SYS5 DEBUG: saved stack pointer (2 bytes). User program SP value saved when DEBUG takes control. Restored by the Go command at 4F80H when resuming execution.
407BH ↳16507	T1	TRSDOS 2.3 SYS5 DEBUG: saved program counter / breakpoint continuation address (2 bytes). Holds the PC value at the time of the breakpoint or interrupt. Used by the Go command to resume execution at the correct address.
407CH ↳16508	N1	NEWDOS/80: Point DE to time limits table at 407CH (59, 59, 23 for sec, min, hour).
407DH ↳16509 ↳TSTK$	Model I ROM, T1	Disk boot stack pointer. SP loaded at 0693H during disk bootstrap.
407DH ↳16509 ↳MSTACK / TSTK$	Model III ROM	16-bit bootstrap stack pointer anchor at 407Dh. Used as the initial Z-80 stack pointer during the Model III ROM bootstrap sequence, before the main RAM has been tested and the normal STKTOP (40A0h) established.

RS-232 / Serial Communication Workspace (4080H-408FH)

Address (Hex/Dec/Label)	Source	Description
4080H ↳16512 ↳RAMLOW / FDIVC	Both Model I and III ROM	Start of the RAM data block that receives a copy of the ROM's relocatable data table (39 bytes from 18F7h). This table contains system constants and variables that the ROM needs to be in writable RAM (e.g., math register seed data for the floating-point routines at 4081h–40ACh). After this copy, 4080h begins the RAM variable area and is the base address from which derived pointers like FDIVC+1, FDIVB+1, etc. are offset.
4081H ↳16513 ↳FDIVC+1	Both Model I and III ROM	Single byte at 4081h acting as the operand for the SUB n instruction at ROM address 08BBh. This is the third byte of a 24-bit subtraction sequence in the FDIV (floating-point divide) routine. During calculation, the ROM patches this byte to perform a multi-byte subtraction with borrow against the mantissa, allowing for high-precision division without using a dedicated multi-byte register.
4085H ↳16517 ↳FDIVB+1 / FDIVB	Both Model I and III ROM	Single byte at 4085h acting as the operand for the SUB n instruction at ROM address 08B6h. This is the middle byte of the 24-bit mantissa subtraction sequence within the FDIV routine. Like FDIVC, it is a self-modifying code target used to store intermediate borrow/subtrahend values during a division operation.
4089H ↳16521 ↳FDIVA+1 / FDIVA	Both Model I and III ROM	Single byte at 4089h acting as the operand for the SUB n instruction at ROM address 08B1h. This is the most significant byte (MSB) of the 24-bit mantissa subtraction sequence in the FDIV routine. It is updated dynamically by the division logic to manage the high-order byte of the subtraction.
408CH ↳16524 ↳FDIVG+1 / FDIVG	Both Model I and III ROM	Single byte at 408Ch acting as the operand for the LD A,n instruction at 08C4h and referenced by multiple branches in the division routine. This location serves as the sign and overflow status flag for the floating-point division process.
408EH ↳16526 ↳MAXFIL	T1	TRSDOS 2.3 / Disk BASIC: MAXFIL — maximum number of open files (1 byte). Set from the answer to the `HOW MANY FILES?` question at BASIC startup. Read by BASIC/CMD: LD HL,(408EH); the ROM tape-BASIC meaning (USR jump address) is replaced under DOS.
408EH ↳16526 ↳LSTEND / USRTAB	Both Model I and III ROM, T1	16-bit address at 408Eh–408Fh, serving dual purpose as LSTEND (the end-of-LIST pointer used by LLIST) and USRTAB (the USR function entry address).
408FH ↳16527 ↳VARREC	T1	TRSDOS 2.3 / Disk BASIC: VARREC — variable-length record flag (1 byte). Written by the OPEN statement processor when FILES are opened for variable-length I/O. 00H = fixed-length records; non-zero = variable-length.

BASIC System Variables (4090H-40FFH)

Address (Hex/Dec/Label)	Source	Description
4090H ↳16528 ↳MULTR	Both Model I and III ROM	8-byte scratch area at 4090h–4097h used as the multiplicand register during the RND pseudo-random number generation computation. The RND function implements a 24-bit linear congruential multiply using a fixed constant; MULTR holds the multiplicand bytes during the multiply loop.
4093H-4098H ↳16531 ↳STAINP	Both Model I and III ROM	BASIC ON ERROR handler vector (3 bytes). Called at 2AF5H.
4094H ↳16532 ↳STAINP+1	Both Model I and III ROM	Single byte at 4094h, the operand byte of the IN A,(N) instruction at 4093h (STAINP), forming a self-modifying I/O instruction. Holds the port number from which the INPORT function reads. Writing to 4094h changes which hardware port the next INPORT call reads; corrupting it will cause INPORT to read from the wrong I/O port.
4096H ↳16534 ↳OUTWRD	Both Model I and III ROM	Error handler address (3 bytes). JP target at 2AFEH. Also tape RAM OUT support.
4097H ↳16535 ↳OUTWRD+1	Both Model I and III ROM	Single byte at 4097h, the operand byte of the OUT (N),A instruction at 4096h (OUTWRD), forming a self-modifying I/O instruction. Holds the port number to which the OUTPORT function writes. Writing to 4097h changes which hardware port the next OUTPORT call targets; corrupting it will send output to the wrong I/O port.
4099H ↳16537 ↳CHARC	Both Model I and III ROM	Single-byte keyboard type-ahead / lookahead buffer at 4099h. Holds the most recently read keyboard character that has not yet been consumed by the BASIC interpreter or an input routine. 00h = buffer empty (no character waiting); non-zero = a character is pending. CHARC acts as a one-character lookahead: the keyboard scanner or INKEY$ deposits a character here, and the next call to the character-fetch routine picks it up and clears it to 00h. Corrupting CHARC inserts a phantom keystroke or swallows a pending one.
409AH ↳16538 ↳ERRFLG	Both Model I and III ROM, N1	Single-byte error-number flag. Holds the BASIC error code of the most recent error (e.g., 02h = SN, 06h = OD, 2Ah = FD), or 00h if no error has occurred. Also serves as the RESUME flag: non-zero indicates an error has been trapped and not yet RESUMEd. Corrupting ERRFLG will cause ERR to return the wrong value and RESUME to malfunction.
409BH ↳16539 ↳LPTPOS	Both Model I and III ROM	Single-byte printer carriage position counter: 00h = printer is at the left margin; any non-zero value is the number of characters already printed on the current line. Corrupting LPTPOS causes LPRINT output to miscount columns and break at the wrong position.
409CH ↳16540 ↳PRTFLG / OUTSEL	Both Model I and III ROM	Single-byte output device selector: FFh (−1) = cassette output, 00h = video display, 01h = printer. Corrupting PRTFLG misdirects all PRINT output.
409DH ↳16541 ↳LPTCFG / LINLEN	Both Model I and III ROM	Single byte at 409Dh holding the BASIC PRINT output line length used for comma-field and TAB calculations. Named LINLEN in the Gates source; initialized to 80 (50h) — the logical line width assumed by the BASIC comma-field formatter, regardless of the Model III's physical 64-column video screen. LINLEN controls where PRINT comma fields wrap: a value of 80 means the BASIC output model treats each printed line as 80 characters wide for purposes of TAB() and comma-field advancement, consistent with the original TRS-80 Model I BASIC. Changing 409Dh narrows or widens the logical output width for PRINT TAB and comma-field calculations; setting it to 40h (64) aligns the BASIC field model with the physical screen.
409EH ↳16542 ↳CLMLST	Model I ROM	Size of print line. Read at 2123H.
409EH ↳16542 ↳CLMLST	Model III ROM	Single byte at 409Eh holding the column position of the last valid PRINT comma field start (NCMPOS). Initialized from the compile-time constant NCMPOS = (((LINLEN / CLMWID) − 1) × CLMWID) = (((80 / 14) − 1) × 14) = 56 (38h): there are five complete 14-column comma zones (at columns 0, 14, 28, 42, 56) in an 80-column line, so 56 is the last column at which a new comma field can begin. When the current cursor column is at or past CLMLST, the next PRINT comma wraps to a new line rather than advancing to a non-existent sixth field. Changing 409Eh alters how many comma zones fit on a line.
409FH ↳16543	Model I ROM	Reserved / unused on Model I.
409FH ↳16543 ↳DORES-durda	Model III ROM	Single byte at 409Fh: the DATA/string-quote flag used by the keyboard driver's character-scan path, tracking whether the current position in the BASIC line being scanned is inside a quoted string or a DATA statement body. 00h = normal token mode; 01h = inside a quoted string or DATA literal (characters should pass through unmodified rather than being tokenized). Corrupting this flag causes quoted strings or DATA literals to be incorrectly tokenized. Sources 069Bh, 06A5h, 06AEh, 06E5h, 06EAh, 06EFh are in Part 1 (the keyboard driver / line-entry routine, 0600h range) and access 409Fh to read or set the in-quote/in-DATA flag during line tokenization.

System Workspace and DOS Linkage (4033H–4407DH)

Address (Hex/Dec/Label)	Source	Description
409FH ↳16543 ↳S3STCK	T3	TRSDOS 1.3: S3STCK — DOS system stack pointer. The command interpreter (SYS01/SYS) resets SP to this address on every entry to CMDABT and CMDRDY.

TRSDOS 1.3 SYS0 System Workspace (4225H-42FFH)

Address (Hex/Dec/Label)	Source	Description
40A0H ↳16544 ↳MEM1	Model III ROM, T3	End-of-memory pointer used by Disk BASIC

BASIC System Variables (4090H-40FFH)

Address (Hex/Dec/Label)	Source	Description
40A0H-40A1H ↳16544 ↳STKTOP	Both Model I and III ROM, N1	16-bit pointer to the top of string space (the highest RAM address available for string data, immediately below the return-address stack). Computed as MEMSIZ − 50 by default. STKTOP defines the upper boundary of the string heap and the lower boundary of the BASIC return stack. Corrupting STKTOP causes string allocations to overlap the stack (resulting in stack corruption) or to falsely report Out-Of-String-Space when memory is actually available. POKE-ing 40A0h,40A1h to a lower value is equivalent to a CLEAR with reduced string space.
40A2H-40A3H ↳16546 ↳CURLIN	Both Model I and III ROM, N1	16-bit currently-executing BASIC line number, updated on every line entry and tested by the error handler and CONT logic. FFFFh = immediate/command mode. FFFFh in CURLIN always signals command/immediate mode; any other value is the active BASIC line number.
40A4H-40A5H ↳16548 ↳TXTTAB	Both Model I and III ROM, N1	16-bit pointer to the start of the BASIC program text area in RAM, normally 42E9h on the Model III. TXTTAB always points one byte before the first BASIC line's link-pointer; the program is stored as a linked list of tokenized lines starting here. Corrupting TXTTAB causes the BASIC program to be lost or to point at random RAM, typically resulting in NEW or stack-corruption symptoms.
40A6H ↳16550 ↳TTYPOS	Both Model I and III ROM	Single-byte cursor column position (0-based, 0–63 for 64-column mode, 0–31 for 32-column mode). Tracks the current horizontal output position for PRINT comma- and TAB-positioning logic. POKE 40A6h,n forces the cursor-column tracker to a specific value, which can confuse subsequent PRINT TAB/comma positioning until the next CR or HOME.
40A7H-40A8H ↳16551 ↳BUFPNT	Both Model I and III ROM, N1	16-bit pointer to the keyboard input buffer. Holds the RAM address where the next keyboard input line will be stored; initialized to 42E8h during power-on. Corrupting BUFPNT causes the keyboard input routine to write the input line at the wrong RAM address, typically destroying part of the BASIC program or variable area.
40A9H ↳16553 ↳CASFLG	Both Model I and III ROM, N1	Single-byte cassette input flag. 00h = keyboard is the current input device; non-zero = cassette is the current input device for INPUT/READ operations.
40AAH-40ACH ↳16554 ↳RNDX	Both Model I and III ROM	16-bit low word (bytes 0–1) of the 3-byte pseudo-random number seed at 40AAh–40ACh. The RND function uses all three bytes as a 24-bit linear congruential generator: each call multiplies the current 24-bit seed by a fixed constant (stored in MULTR, 4090h) to produce the next seed, then scales the result into a floating-point value between 0 and 1. The sequence has a period of 2^24 (about 16.7 million) before repeating. POKE 40AAh,n and POKE 40ABh,n modify the low seed bytes, biasing subsequent RND results.
40ABH ↳16555 ↳RNDX+1	Both Model I and III ROM	Second byte of the 3-byte pseudo-random number seed at 40AAh–40ACh (RNDX).
40ACH ↳16556 ↳RNDX+2	Both Model I and III ROM	Single byte at 40ACh, the high (third) byte of the 3-byte pseudo-random number seed at 40AAh–40ACh. POKE 40ACh,n biases the high byte of the seed, producing a different sequence of pseudo-random numbers.
40AEH ↳16558 ↳DIMFLG	Both Model I and III ROM	Single-byte variable locate/create flag. 00h = locate mode (find an existing variable, error if not found); non-zero = create mode (create the variable if it does not exist, as in DIM). Also carries subscript-presence information. Corrupting DIMFLG causes the variable-lookup to either always create or always error on missing variables.
40AFH ↳16559 ↳VALTYP / SAFLAG	Both Model I and III ROM, N1	Single-byte current value type flag: 02h = integer, 03h = string, 04h = single-precision float, 08h = double-precision float. Set whenever a value is loaded into the FAC (REG 1) and consulted by every expression-evaluation, type-coercion, and assignment routine. Corrupting VALTYP causes the interpreter to misinterpret the FAC's contents — for example, treating a floating-point number as a string descriptor, which produces ?TM ERROR or random-data BASIC results.
40B0H ↳16560 ↳DORES / OPRTYP	Both Model I and III ROM	Single byte at 40B0h, used as a temporary operator-token store during expression evaluation (named OPRTYP in Part 3). Corrupting OPRTYP mid-expression will cause the wrong operator to be executed.
40B1H-40B2H ↳16561 ↳MEMSIZ / MEMTOP	Both Model I and III ROM, N1	16-bit word holding the top of usable RAM as supplied by the user (or detected automatically) at the 'MEMORY SIZE?' prompt. MEMSIZ defines the highest address available to BASIC; above it lies any DOS workspace or memory-protected machine-language area. Corrupting MEMSIZ causes BASIC to either crash by writing past physical RAM or to underutilize available memory.
40B3H-40B4H ↳16563 ↳TEMPPT	Both Model I and III ROM, N1	16-bit pointer to the next available slot in the temporary string descriptor work area (TEMPST, at 40B5h). Temporary string descriptors (3 bytes each: length, address low, address high) are stacked here during string expression evaluation. Corrupting TEMPPT causes temporary string descriptors to be written to the wrong location, overwriting live data or missing live descriptors during garbage collection.
40B5H-40D2H ↳16565 ↳TEMPST	Both Model I and III ROM	Base address of the temporary string descriptor work area. TEMPST spans 40B5h–40D2h (30 bytes = room for up to 10 three-byte string descriptors). Corrupting the content of TEMPST (40B5h–40D2h) without updating TEMPPT correctly will leave dangling or phantom string descriptors. TEMPST itself is never written directly; only TEMPPT is moved within it.
40D3H-40D5H ↳16595 ↳DSCTMP	Both Model I and III ROM	3-byte temporary string descriptor (DSCTMP spans 40D3h–40D5h: byte at 40D3h = string length, 16-bit word at 40D4h = string data address). Used to build a new string descriptor before it is registered in TEMPST. Corrupting DSCTMP before PUTNEW is called will register a descriptor pointing to the wrong string data or with the wrong length.
40D4H-40D5H ↳16598 ↳DSCTMP+1	Both Model I and III ROM	16-bit word at 40D4h–40D5h (bytes 1–2 of the DSCTMP string descriptor), holding the RAM address of the string data for the most recently allocated temporary string. Corrupting DSCTMP+1 causes string operations to write into the wrong RAM area.
40D6H-40D7H ↳16600 ↳FRETOP	Both Model I and III ROM, N1	16-bit pointer to the next available byte at the top of string space (the free area grows downward from MEMSIZ toward the program). FRETOP is the high-water mark: all string data below FRETOP is live; all above is free. If FRETOP advances past STREND (40FDh), the next string allocation will trigger an OS (Out of String Space) error.
40DAH-40DBH ↳16602 ↳DATLIN	Both Model I and III ROM	16-bit line number of the DATA statement currently being scanned by a READ operation. Updated each time the DATA-finder advances to a new BASIC line, so that if a type mismatch or other error occurs during READ, the error message can cite the DATA line rather than the READ line. If no DATA statement has been reached yet, DATLIN holds whatever was last written (possibly a stale value); a RESTORE resets DATPTR but does not clear DATLIN.
40D8H-40D9H ↳16602 ↳TEMP3	Both Model I and III ROM	16-bit general-purpose temporary storage, used by several unrelated routines as a scratch pointer or saved value. Sources 0FDCh, 0FFBh, 1034h, and 1289h are in Parts 1 and 2 and are used during floating-point output (FOUT) to save and restore a buffer or digit-count pointer.
40DCH ↳16604 ↳SUBFLG	Both Model I and III ROM, N1	Single-byte subscript/FOR flag. Carries two overloaded meanings: (a) non-zero = the variable name being looked up has array subscripts (i.e. it is an array element access, not a simple variable); (b) a specific non-zero value (64h) distinguishes a FOR-loop variable lookup from an ordinary subscripted access. Corrupting SUBFLG causes simple variables to be treated as arrays or vice versa.
40DDH ↳16605 ↳BFKLFL	Both Model I and III ROM	Single-byte flag used by the interpreter's line-input and tokenizer path, tracking whether a line-feed or function-key prefix byte was seen during keyboard input. 00h = no prefix; non-zero = a special prefix character was detected. Corrupting BFKLFL can cause the interpreter to re-enter the input loop spuriously or to misinterpret a multi-byte key sequence.
40DEH ↳16606 ↳FLGINP	Both Model I and III ROM	Single-byte READ/INPUT discriminator flag, also reused as the PRINT USING string-separator flag (USFLAG/USFLG). 00h = INPUT statement is active; non-zero (AFh) = READ statement is active. Corrupting FLGINP during an active READ will cause INPUT-style re-prompting instead of a syntax error, or vice versa.
40DFH-40E0H ↳16607 ↳TEMP	Both Model I and III ROM, N1	16-bit general-purpose temporary storage, used by several unrelated routines. Corrupting TEMP mid-expression will cause the interpreter to branch to an arbitrary program address.
40E1H ↳16609 ↳AUTFLG	Both Model I and III ROM	Single-byte AUTO-mode flag at 40E1h: 00h = AUTO mode is off (normal interactive line entry); non-zero = AUTO mode is active and the interpreter prints a tentative line number before each input prompt. POKE 40E1h,1 enables AUTO mode without going through the AUTO command; POKE 40E1h,0 disables it without pressing BREAK.
40E2H-40E3H ↳16610 ↳AUTLIN	Both Model I and III ROM	16-bit current AUTO line number. Holds the next line number that will be offered to the user in AUTO mode. Modifying AUTLIN directly changes the next line number offered in AUTO mode.
40E4H-40E5H ↳16612 ↳AUTINC	Both Model I and III ROM	16-bit AUTO increment value. Holds the step size added to AUTLIN after each AUTO-mode input line. Setting AUTINC to 0 would cause AUTO to repeat the same line number endlessly.
40E6H-40E7H ↳16614 ↳SAVTXT	Both Model I and III ROM	16-bit saved BASIC program-text pointer. Holds the address of the last BASIC byte being executed, used to preserve the interpreter's position across error handling, BREAK, and STOP. Corrupting SAVTXT causes RESUME to branch to the wrong instruction.
40E8H-40E9H ↳16616 ↳SAVSTK / ERRMORH	Both Model I and III ROM	16-bit saved stack-pointer value. Holds the Z-80 SP value at the point where the current BASIC statement began executing, used by the error handler to restore the stack to a known-good state before dispatching an error or restarting execution.
40EAH-40EBH ↳16618 ↳CURLIN / ERRLIN	Both Model I and III ROM	16-bit current BASIC line number being executed (or FFFFh in immediate/command mode). FFFFh in CURLIN indicates immediate mode; any other value is the line number of the last executed (or erroring) statement.
40ECH-40EDH ↳16620 ↳ERRLIN / DOT	Both Model I and III ROM, N1	16-bit EDIT line number / DOT variable (last-referenced line number). Used both as the line number for the EDIT command target and as the implicit "." (dot) variable in the EDIT and LIST commands meaning "current line". If ERRLIN/DOT is corrupted, EDIT and LIST with "." will reference the wrong line.
40EEH-40EFH ↳16622 ↳ERRTXT	Both Model I and III ROM	16-bit saved program-text pointer used by RESUME. Holds the address in the BASIC program text where an error occurred, so that RESUME or RESUME 0 can return execution to the correct point. If ERRTXT is corrupted, RESUME will branch to an arbitrary address.
40F0H-40F1H ↳16624 ↳ONELIN	Both Model I and III ROM, N1	16-bit address of the BASIC line to branch to on an ON ERROR GOTO. Holds the internal line-address (not line number) of the error handler set by ON ERROR GOTO; 0000h means no ON ERROR handler is active. Setting ONELIN to 0000h disables ON ERROR handling; setting it to a non-zero value directs errors to that BASIC line.
40F2H ↳16626 ↳ONEFLG	Both Model I and III ROM	Single-byte ON ERROR active flag: 00h = not inside an ON ERROR handler; non-zero (FFh) = currently executing inside the ON ERROR routine. Prevents recursive ON ERROR handling. Corrupting ONEFLG can either prevent ON ERROR handlers from running or allow infinite error-handler recursion.
40F3H-40F4H ↳16627 ↳TEMP2 / VARPTR base	Both Model I and III ROM	16-bit general-purpose temporary storage, used during floating-point number formatting (FOUT) to hold the position of the decimal point within the ASCII output buffer. This location is strictly a scratch register; its value is only valid within the scope of the routine that wrote it.
40F5H-40F6H ↳16629 ↳OLDLIN	Both Model I and III ROM	16-bit line number of the last BASIC line that was executed before a BREAK, STOP, or END, used to support the CONT command. If OLDLIN is zero, CONT reports "Can't CONTINUE".
40F7H-40F8H ↳16631 ↳OLDTXT	Both Model I and III ROM	16-bit saved program-text pointer for CONT. Holds the byte address within the BASIC program where execution was interrupted by BREAK, STOP, or END, allowing CONT to resume at the exact statement. CONT cannot resume if OLDTXT is 0000h.
40F9H-40FAH ↳16633 ↳VARTAB	Both Model I and III ROM, N1	16-bit pointer to the start of the simple-variable storage area (immediately after the end of the BASIC program text). VARTAB must equal TXTTAB + program-length; any corruption causes variable operations to overwrite program text or miss variables.
40FBH-40FCH ↳16635 ↳ARYTAB	Both Model I and III ROM, N1	16-bit pointer to the start of the BASIC array-variable storage area (immediately after the simple-variable area). Corrupting ARYTAB causes the interpreter to overlap the simple-variable and array areas, corrupting both.
40FDH-40FEH ↳16637 ↳STREND	Both Model I and III ROM, N1	16-bit pointer to the first byte of free memory above all variables and arrays (the high-water mark of the heap). If STREND is set too low it will overlap live variable data; set too high it will waste or overwrite string space.
40FFH-4100H ↳16639 ↳DATPTR	Both Model I and III ROM	16-bit READ/DATA pointer. Holds the address of the next DATA item to be consumed by a READ statement. Corrupting DATPTR causes READ to fetch values from the wrong location; a pointer past the end of all DATA produces an OD (Out of Data) error.

Variable Type Table and Trace Flag (4101H-411BH)

Address (Hex/Dec/Label)	Source	Description
4101H-411AH ↳16641 ↳DEFTBL	Both Model I and III ROM	26-byte DEFINT/DEFSNG/DEFDBL/DEFSTR variable-type declaration table, one byte per letter A–Z (4101h = 'A', 4102h = 'B', … 411Ah = 'Z'). Each byte holds the default numeric type for variables starting with that letter: 02h = integer, 04h = single-precision, 08h = double-precision, 03h = string. Corrupting DEFTBL causes variables to be treated as the wrong type, producing incorrect computation results or type-mismatch errors.
411BH ↳16667 ↳TRCFLG	Both Model I and III ROM	Single-byte TRON/TROFF flag: 00h = TROFF (trace off); non-zero (AFh) = TRON (trace on). Programs can query or set TRCFLG directly via POKE to enable or disable tracing without the TRON/TROFF commands.

Floating-Point Accumulator / Math Workspace (411CH-4130H)

Address (Hex/Dec/Label)	Source	Description
411CH ↳16668 ↳DFACLO-1	Both Model I and III ROM	Single byte at 411Ch, one byte below the double-precision floating-point accumulator DFACLO (411Dh). Serves as an extension byte for double-precision shift and normalization operations.
411DH-4124H ↳16669 ↳DFACLO	Both Model I and III ROM	16-bit low word (bytes 0–1) of the 8-byte double-precision floating-point accumulator (DFAC), at 411Dh–411Eh. The DFAC spans 411Ch–4124h (with guard byte at 411Ch); DFACLO holds the two least-significant mantissa bytes.
411FH ↳16671 ↳DFACLO+2	Both Model I and III ROM	Single byte at 411Fh, the third byte (bytes 2) of the double-precision accumulator DFAC (411Dh–4124h).
4120H ↳16672 ↳FACLO-1	Both Model I and III ROM	Single byte at 4120h, one byte below the single-precision floating-point accumulator FACLO (4121h).
4121H-4122H ↳16673 ↳FACLO	Both Model I and III ROM, N1	16-bit word at 4121h–4122h: the low two bytes of the floating-point mantissa in the FAC (Floating-point ACcumulator), and the standard low-address entry point into the FAC block (4121h–4124h). For Integer: FACLO holds the 16-bit signed integer value directly (LHLD/SHLD FACLO reads or writes the integer). For Single Precision: bytes at 4121h (bits 1–8 of mantissa), 4122h (bits 9–16), and 4123h (FAC-1, bits 17–24 plus sign) form the 24-bit mantissa; the exponent is at FAC (4124h). The full single-precision number occupies 4121h–4124h. For Double Precision: FACLO is the upper portion of the double-precision mantissa; the four additional least-significant bytes are in DFACLO (411Dh–4120h). For Strings: FACLO holds a 16-bit pointer to the string descriptor; LHLD FACLO retrieves the descriptor address. All arithmetic routines (FADD, FSUBS, FMULT, FDIV, FCOMP, MOVRF, MOVMF, MOVFR, PUSHF, integer conversion, double-precision operations, string operations) use FACLO as the standard FAC base address for block copies, compares, loads, and stores. The result of every one-argument function is left in FACLO/FAC. For two-argument operations: Integer and Single Precision place the first argument in registers B,C,D,E and the second in FAC/FACLO, leaving the result in FACLO/FAC. Double Precision places the first argument in FAC/FACLO and the second in ARG/ARGLO, leaving the result in FACLO/FAC. POKE 4121h,n and POKE 4122h,n alter the low mantissa bytes of the FAC; setting both to 0 while also zeroing FAC (4124h) produces a clean zero.
4123H-4124H ↳16675 ↳FAC-1	Both Model I and III ROM, N1	Single byte at 4123h: the most significant byte (MSB) of the floating-point mantissa in the FAC, holding the sign bit in bit 7 and mantissa bits 2–8 in bits 0–6 (bit 1 of the mantissa is always an implicit 1 and is not stored). For Integer and Single Precision: this is the third mantissa byte of the 3-byte FACLO block (4121h–4123h); bit 7 is the sign (0=positive, 1=negative). For Double Precision: FAC-1 is the high mantissa byte of the 8-byte double-precision FAC (411Ch–4124h). Sign is stored in bit 7: the sign of the entire FAC number is the sign bit of FAC-1 regardless of numeric type. Negation flips bit 7 of FAC-1 via XRI 80h (Gates: NEG, NEGR, ABS all operate on FAC-1 to toggle or clear the sign). The comparison routine SIGNC reads FAC-1 to determine the sign of the FAC for SGN() and comparison operations. During FADD/FSUBS, FAC-1 is unpacked before addition: the assumed 1-bit is inserted into position, the sign is separated, and after the operation the result sign is placed back into bit 7 of FAC-1. During FMULT/FDIV, the product sign is computed from the XOR of both operand signs and written into FAC-1 at the end. The high half of the FAC (FAC-1 at 4123h and FAC exponent at 4124h) is routinely saved and restored as a 16-bit word via LD HL,(4123H) / LD (4123H),HL during stack-based save/restore sequences. POKE 4123h,n+128 makes the FAC negative; POKE 4123h,n without bit 7 set makes it positive.
4124H ↳16676 ↳FAC	Both Model I and III ROM	Single byte at 4124h: the biased binary exponent of the FAC (Floating-point ACcumulator). For Integer and Single Precision: exponent is biased by 80h (128 decimal) — a stored value of 81h means 2^1, 80h means 2^0, 82h means 2^2, etc. A stored value of 00h is the special zero sentinel: the entire FAC is treated as exactly 0.0 regardless of the mantissa bytes, and FACLO/FAC-1 are ignored. For Double Precision: FAC holds the exponent of the 8-byte double-precision accumulator using the same excess-80h bias, with the additional mantissa bytes in DFACLO (411Dh). The exponent range is 01h–FFh representing 2^(-127) through 2^127; 00h always means zero. To shift the FAC right by 1 bit: INC (FAC). To shift left by 1 bit: DEC (FAC). Every arithmetic operation (FADD, FSUBS, FMULT, FDIV, DADD, DMUL, DDIV) tests FAC for zero before operating, aligns operand exponents by comparing FAC against the other operand's exponent, and writes the result exponent back to FAC. Overflow (exponent wraps above FFh) jumps to ERROV; underflow (wraps below 01h) produces zero. POKE 4124h,0 zeros the FAC regardless of other bytes; POKE 4124h,n sets the magnitude of the FAC's next use.
4125H ↳16677 ↳FAC+1	Both Model I and III ROM	Single byte at 4125h: the temporary sign-storage byte for the floating-point routines, holding the sign bit (in bit 7) of an intermediate floating-point computation. Although this is just past the 5-byte single-precision FAC (4121h–4124h plus the implicit sign in 4123h), it is reused by the math routines as scratch space for sign manipulation. The HTM annotation explicitly notes 'NOTE: 4125H-4126H is used by floating point routines.' POKE 4125h alters the temporary sign byte; this is normally only meaningful while a floating-point operation is in progress, since the byte is rewritten by every math routine that touches it.
4126H ↳16678 ↳ARGLO-1	Both Model I and III ROM	Single byte at 4126h: the overflow/guard byte one position below ARGLO (4127h), used exclusively during double-precision arithmetic. For Integer and Single Precision: unused. For Double Precision: when DSHFTR right-shifts the ARG mantissa during exponent alignment in DADD/DSUB, the bits shifted out of the least-significant byte of ARG fall into this byte. After the shift, the code at 0CB3h reads (4126h) and copies it to DFACLO-1 (411Ch) via LD A,(4126H) / LD (411CH),A, transferring the shifted-out bits into the FAC's guard byte so the rounding logic at the end of double-precision add/subtract can account for the lost precision. Outside an active double-precision add or subtract, this byte is transient and meaningless.
4127H-412EH ↳16679 ↳ARGLO / ARG-7	Both Model I and III ROM	Base address of the ARG (second-operand) register's mantissa bytes, at 4127h. ARG is the second floating-point operand used by two-argument math operations. For Integer and Single Precision: the first argument is passed in CPU registers B,C,D,E and the second is in FAC/FACLO; ARG/ARGLO are not used. For Double Precision: the calling convention is reversed — the first operand is in FAC/FACLO and the second operand is in ARG/ARGLO. ARGLO (4127h) is the least-significant byte of the ARG mantissa. The full double-precision ARG block runs from ARGLO (4127h, least significant) up through ARG-1 (412Ch, sign and high mantissa byte) to ARG (412Dh, exponent) — eight bytes total. (Note: the single-precision ARG exponent is at 412Eh, which is ARG for the single-precision layout.) All sources load HL or DE with 4127h to point at the base of the ARG mantissa block for block-copy (VMOVE, VMOVFA), byte-by-byte comparison (DCOMP/DCOMPD), or multi-byte arithmetic operations (DADD, DSUB, DMUL, DDIV). VMOVAF (move FAC to ARG) stores the current FAC into ARG/ARGLO; VMOVFA (move ARG to FAC) loads ARGLO into the FAC. During double-precision operations, the shift routine DSHFTR operates on the ARG block starting from ARG-1 downward toward ARGLO, with overflow falling into ARGLO-1 (4126h).
412DH ↳16685 ↳ARG-1	Both Model I and III ROM	Single byte at 412Dh: the high-mantissa-and-sign byte of the ARG register (one byte below the ARG exponent at 412Eh). In the ARG block layout, ARGLO (4127h) is the least-significant mantissa byte and ARG-1 (412Dh = ARGLO+6) is the most significant mantissa byte; it holds the sign of ARG in bit 7 and the high mantissa bits in bits 0–6. For Integer and Single Precision: ARG is the second operand of two-argument operations. ARG-1 carries the sign of the single-precision ARG value; negating ARG flips bit 7 of ARG-1. For Double Precision: ARG-1 is the high byte of the 7-byte ARG mantissa (ARGLO through ARG-1), carrying the sign in bit 7.
412EH ↳16686 ↳ARG	Both Model I and III ROM	Single byte at 412Eh: the biased binary exponent of the ARG register (second operand). Uses the same excess-80h bias as FAC (4124h): 00h means ARG is exactly zero, 81h means 2^1, 80h means 2^0, etc. For Integer and Single Precision: the first argument is in registers B,C,D,E and the second is in FAC; ARG/412Eh is used here as a scratch exponent byte for the single-precision ARG (second operand in compare and negate operations). A zero at 412Eh means the single-precision ARG is zero — the negate routine (0C77h) tests this to avoid flipping the sign of a zero. For Double Precision: the calling convention reverses — the first operand is in FAC and the second is in ARG. The double-precision ARG exponent is at 412Eh; the 7-byte mantissa runs from ARGLO (4127h) through ARG-1 (412Dh). DADD/DSUB read the ARG exponent at 412Eh to align the two operands' mantissas before adding. POKE 412Eh,0 makes the ARG appear to be zero to any subsequent operation that checks it.
412FH ↳16687 ↳FBUFFR	Both Model I and III ROM	16-bit base address of the 35-byte floating-point ASCII output buffer (FBUFFR spans 412Fh–4151h). The base address 412Fh is used as a reference sentinel; the actual digit output starts at FBUFFR+1 (4130h). This entry point is reached after the conversion loop at 10C0h completes, marking the end of the mantissa digit collection phase.
4130H-4149H ↳16688 ↳FBUFFR+1	Both Model I and III ROM	First usable byte of the floating-point ASCII output buffer (FBUFFR+1 = 4130h), used to accumulate the digit characters and formatting marks during floating-point-to-ASCII (FOUT) conversion. All three sources load HL with 4130h to access the buffer. Corrupting FBUFFR+1 during an active FOUT call will produce garbled number output.
414AH ↳16714 ↳FBUFFR+27	Both Model I and III ROM	Byte at 414Ah (FBUFFR+27), used as the destination address for double-precision ARG block-copy operations during floating-point divide and normalize routines. This reuse of the upper FBUFFR as a scratch area means FBUFFR+27 through FBUFFR+34 (414Ah–4151h) must not be disturbed during double-precision divide operations.
414FH ↳16719 ↳FMLTT1	Both Model I and III ROM	Single byte at 414Fh: temporary accumulator for the carry/partial-product byte during the single-precision floating-point multiply loop. This byte acts as the intermediate carry accumulator between successive 8-bit multiply steps; its value is only valid inside the FMULT loop.
4150H-4151H ↳16720 ↳FMLTT2	Both Model I and III ROM	16-bit temporary partial-product word at 4150h–4151h, used during the single-precision floating-point multiply loop and as a scratch block-copy destination in double-precision operations. The overlap between FMULT use (4150h–4151h as a 16-bit word) and DFLOAT use (4150h as block destination) means these two routines must not interleave.
4151H ↳16721 ↳FBUFFR+34	Both Model I and III ROM	Byte at 4151h (FBUFFR+34), the last byte of the floating-point ASCII output buffer, reused as a single-byte scratch location during double-precision arithmetic. This is the final byte of the FBUFFR scratch region used by the double-precision routines; it holds a transient value only valid within the immediate instruction sequence.

Disk BASIC Entry Points / Driver Vector Table (4152H-41E4H)

Address (Hex/Dec/Label)	Source	Description
4152H ↳16722 ↳ERCALL	Both Model I and III ROM	Start of the error-handler jump table installed in RAM at 4152h. Changing the destination address at init time would redirect all unpatched error calls.
4155H ↳16725	Both Model I and III ROM	Disk BASIC: FN / VARPTR vector.
4158H ↳16728	Both Model I and III ROM	Disk BASIC: CVS vector.
415BH ↳16731	Both Model I and III ROM	Disk BASIC: DEF vector.
415EH ↳16734	Both Model I and III ROM	Disk BASIC: CVD vector.
4161H ↳16737	Both Model I and III ROM	Disk BASIC: EOF vector.
4164H ↳16740	Both Model I and III ROM	Disk BASIC: LOC vector.
4167H ↳16743	Both Model I and III ROM	Disk BASIC: LOF vector.
416AH ↳16746	Model III ROM	Disk BASIC: MKI$ vector (Model III only).
416DH ↳16749	Model III ROM	Disk BASIC: MKS$ vector (Model III only).
4170H ↳16752	Both Model I and III ROM	Disk BASIC: MKD$ vector.
4173H ↳16755	Both Model I and III ROM	Disk BASIC: CMD vector.
4176H ↳16758	Both Model I and III ROM	Disk BASIC: TIME$ / SGN function vector.
4177H ↳16759 ↳TIME+1	Model III ROM	16-bit operand word at 4177h–4178h, forming bytes 1–2 of the 3-byte JP instruction at 4176h (TIME$). The TIME$ vector at 4176h is initialized during ERCALL table setup to JP 012Dh (?L3 ERROR), because the base Model III ROM treats TIME$ as a DOS-only function.
4179H ↳16761	Both Model I and III ROM	Disk BASIC: OPEN vector.
417CH ↳16764	Both Model I and III ROM	Disk BASIC: FIELD vector.
417FH ↳16767	Both Model I and III ROM	Disk BASIC: GET vector.
4182H ↳16770	Both Model I and III ROM	Disk BASIC: PUT vector.
4185H ↳16773	Both Model I and III ROM	Disk BASIC: CLOSE vector.
4188H ↳16776	Both Model I and III ROM	Disk BASIC: LOAD vector.
418BH ↳16779	Both Model I and III ROM	Disk BASIC: MERGE vector.
418EH ↳16782	Both Model I and III ROM	Disk BASIC: NAME vector.
4191H ↳16785	Both Model I and III ROM	Disk BASIC: KILL vector.
4194H ↳16788	Both Model I and III ROM	Disk BASIC: & (ampersand) vector.
4197H ↳16791	Both Model I and III ROM	Disk BASIC: LSET vector.
419AH ↳16794	Both Model I and III ROM	Disk BASIC: RSET vector.
419DH ↳16797	Both Model I and III ROM	Disk BASIC: INSTR vector.
41A0H ↳16800	Both Model I and III ROM	Disk BASIC: SAVE vector.
41A3H ↳16803	Both Model I and III ROM	Disk BASIC: LINE vector.
41A6H ↳16806 ↳RETCNT	Both Model I and III ROM	Error processing vector. RET in cassette BASIC; JP to long error messages in Disk BASIC. Start of 21 hookable RET stubs.
41A9H ↳16809	Both Model I and III ROM	DOS link for USR N (3 bytes). Called at 27FEH.
41ACH ↳16812	Both Model I and III ROM	DOS link for READY prompt. Called at 1A1CH.
41AFH ↳16815	Model I ROM	DOS exit from 0368H. Keyboard line input.
41AFH ↳16815	Model III ROM	DOS link for INKEY$ / keyboard input. Called at 0368H.
41B2H ↳16818	Both Model I and III ROM	DOS exit from 1AA1H. After BASIC line tokenized.
41B5H ↳16821	Both Model I and III ROM	DOS exit from 1AECH. After program line table updated.
41B8H ↳16824	Both Model I and III ROM	DOS exit from 1AF2H. After above + CLEAR.
41BBH ↳16827	Both Model I and III ROM	DOS exit from 1B8CH, 1DB0H. NEW/END processing, close files.
41BEH ↳16830	Both Model I and III ROM	PRINT# / PRINT output hook. Called from 2174H. Level II: RESET button vector.
41C1H ↳16833	Both Model I and III ROM	Byte output to any device. Called from 032CH.
41C4H ↳16836	Both Model I and III ROM	ROM KB scan hook. Called from 0358H. INKEY$ + BREAK check.
41C7H ↳16839	Both Model I and III ROM	DOS exit from 1EA6H. RUN with filename/line number.
41CAH ↳16842	Both Model I and III ROM	DOS exit from 206FH. Print processing, check for PRINT#.
41CDH ↳16845	Both Model I and III ROM	DOS exit from 20C6H. After number to ASCII, before print.
41D0H ↳16848	Both Model I and III ROM	DOS exit from 2103H. After PRINT sends CR.
41D3H ↳16851	Both Model I and III ROM	DOS exit from 2108H, 2141H. Comma tabs and TAB statement.
41D6H ↳16854	Both Model I and III ROM	INPUT# hook. Called from 219EH.
41D9H ↳16857	Both Model I and III ROM	Left-side MID$ hook. JP at 2AECH. Only DOS exit that's a JP, not CALL.
41DCH ↳16860	Both Model I and III ROM	READ/INPUT variable assignment. Called from 222DH.
41DFH ↳16863	Both Model I and III ROM	DOS exit from 2278H, 2B44H. After INPUT assign + LIST processing.

Device Control Blocks (41E5H-41FCH)

Address (Hex/Dec/Label)	Source	Description
41E0H ↳16864	N1	NEWDOS/80: Load the Stack Pointer with 41E0H, resetting to the top of the DOS stack area.

Disk BASIC Entry Points / Driver Vector Table (4152H-41E4H)

Address (Hex/Dec/Label)	Source	Description
41E2H ↳16866	Both Model I and III ROM	SYSTEM command hook. Called from 02B2H before *? prompt.

Device Control Blocks (41E5H-41FCH)

Address (Hex/Dec/Label)	Source	Description
41E5H-42E8H ↳16869 ↳BUFINI-3	Model I ROM	Single unified DCB. ROM at 0080H inits to 3AH,00H,2CH. I/O buffer at 41E8H (256 bytes) through 42E8H.
41E5H-41ECH ↳16869 ↳RIDCB / BUFINI-3	Model III ROM	Start of the RS-232 Input Device Control Block (8 bytes at 41E5h–41ECh).
41E8H ↳16872 ↳BUFINI	Both Model I and III ROM	Start of the 1-character RS-232 Input buffer at 41E8h (byte at IX+03h of RIDCB, the RS-232 Input Device Control Block). Holds the most recently received RS-232 byte, or 00h if no character has arrived. The RS-232 receive interrupt stores incoming bytes here; the RSIN driver at 365Ah reads and clears this location via LD (IX+03H),A.
41EDH-41F4H ↳16877 ↳RODCB	Model III ROM	Start of the RS-232 Output Device Control Block (8 bytes at 41EDh–41F4h).
41F0H ↳16880 ↳RODCB+3 / RSTX	Both Model I and III ROM	Byte at 41F0h (IX+03h of RODCB, the RS-232 Output Device Control Block), serving as the 1-character RS-232 output buffer. Holds the byte most recently queued for RS-232 transmission. The RS-232 transmit routine at 3680h writes the character to send into this location via LD (IX+03H),A before activating the transmit interrupt.
41F4H ↳16884	Both Model I and III ROM	Value 103. First of 2 to change LINE to LPRINT.
41F5H-41FCH ↳16885 ↳RNDCB	Both Model I and III ROM	Start of the RS-232 Init/Control Device Control Block (8 bytes at 41F5h–41FCh), used to configure the RS-232 interface parameters (baud rate, word length, parity, stop bits).
41F8H ↳16888 ↳BUFINI+20	Both Model I and III ROM, N1	$RSINIT: Baud rate code. Bits 7-4=TX, 3-0=RX. Also Model I cold-start stack (SP at 00ACH); Model III uses 42F8H.
41F9H ↳16889	Both Model I and III ROM, N1	$RSINIT: Parity/word/stop-bit code. Default 108.
41FAH ↳16890	Both Model I and III ROM, N1	$RSINIT: Wait switch. 0=wait, non-zero=no wait.
41FDH ↳16893 ↳LROW	Model III ROM	Single byte at 41FDh holding the saved keyboard-row number (0–7) of the last key position detected during the keyboard scan. Named LROW (Last Row). LROW is used alongside LCOL (41FEh) to identify the specific key by its (row, column) coordinates in subsequent debounce and character-lookup steps.
41FEH ↳16894 ↳LCOL	Model III ROM	Single byte at 41FEh holding the saved keyboard-column bit-mask of the last key position detected during the keyboard scan. Named LCOL (Last Column).
41FFH-4200H ↳16895 ↳TDELAY	Model III ROM	16-bit auto-repeat delay counter reload value at 41FFh–4200h. Holds the number of keyboard interrupt ticks to wait before beginning key auto-repeat after a key is first pressed. The initial TDELAY value is set during RS-232 or keyboard DCB initialization; modifying it via POKE adjusts the auto-repeat onset delay.

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4200H-42FFH ↳16896	T1, N1	TRSDOS 2.3: directory sector buffer (256 bytes, 4200H–42FFH). Loaded from disk by SYS0 routines 4AC1H (read directory sector into 4200H) and 4AD6H (write directory and GAT sectors). The BOOT/SYS bootstrap code is initially loaded here at address 4200H.

Model III System Variables and Cassette Data (4201H-4224H)

Address (Hex/Dec/Label)	Source	Description
4201H-4202H ↳16897 ↳TCOUNT	Model III ROM, N1	16-bit auto-repeat tick counter at 4201h–4202h. Counts down from TDELAY (41FFh) on each keyboard interrupt tick; when it reaches zero, an auto-repeat keystroke is generated.

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4202H ↳16898	N1	NEWDOS/80: Fetch byte from 4202H (disk buffer).

Model III System Variables and Cassette Data (4201H-4224H)

Address (Hex/Dec/Label)	Source	Description
4203H-4205H ↳16899	Model III ROM, T3	Disk error vector / BREAK key vector (3 bytes). Init to JP 022EH.
4206H-4208H ↳16902	Model III ROM	Disk function vector / interrupt #4 (3 bytes). Non-disk: JP 35FAH (RET).
4209H-420BH ↳16905	Model III ROM	Disk function vector / interrupt #5 (3 bytes). Non-disk: JP 35FAH (RET).
420CH-420DH ↳16908 ↳WRILOC	Model III ROM	16-bit cassette write vector: holds the address of the ROM routine to actually write one bit or byte to tape.
420EH-420FH ↳16910 ↳REDLOC	Model III ROM	16-bit cassette read vector: holds the address of the ROM routine to actually read one bit or byte from tape.
4210H ↳16912 ↳IOSTAT / CAST$	Model III ROM	Single-byte shadow of I/O port ECh (the Miscellaneous Control port). Each bit controls a hardware feature: bit 0 = real-time clock display enable, bit 1 = cassette motor on/off (1=motor on), bit 2 = double-size (wide) character mode, bit 3 = alternate character set (Kana). Writing to port ECh takes effect immediately; 4210h is kept in sync so the ROM can read the current port state without re-reading hardware.
4211H ↳16913 ↳CASDCB	Model III ROM	Single-byte cassette baud-rate selector: 00h = 500 baud, non-zero = 1500 baud.
4212H ↳16914 ↳BLINK	Model III ROM	Single byte at 4212h holding the cassette motor/cursor blink counter. Counts down on each clock interrupt tick to produce a visible blink of the cassette tape-motion indicator on the screen, confirming cassette I/O activity. The initial reload value determines the blink rate; a larger value produces a slower blink.
4213H ↳16915 ↳MSKSTA	Model III ROM	Single byte at 4213h holding the default maskable-interrupt mask value to restore when the cassette stops. Controls which interrupt sources are enabled after cassette I/O completes.
4214H ↳16916 ↳SCRLCT	Model III ROM, T3	Single-byte protected-lines count (bits 0–2 used, giving a value of 0–7), specifying how many screen rows at the top are protected from scrolling.
4216H ↳16918 ↳TICKIT	Model III ROM	Single byte at 4216h: the real-time clock heartbeat counter. Counts down from 1Eh (30) on each 50 Hz (or 60 Hz) real-time clock interrupt; when it reaches 00h it is reloaded to 1Eh and the clock display and TIME registers are updated. When zero, the counter is reloaded with 1Eh and HL is advanced to 4217h (SECONDS) to begin the seconds/minutes/hours rollover chain.
4217H ↳16919	Model III ROM	Clock: Seconds (00-59). POKEable.
4218H ↳16920	Model III ROM, N1	Clock: Minutes (00-59). POKEable.
4219H ↳16921 ↳TICKIT+3	Model III ROM	Single byte at 4219h holding the current HOUR (0–23) of the real-time clock. Part of the TICKIT block: 4216h = heartbeat counter, 4217h = seconds, 4218h = minutes, 4219h = hours, 421Ah = year, 421Bh = day, 421Ch = month.
421AH ↳16922	Model III ROM, T3	Clock: Year (00-99). POKEable.
421BH ↳16923	Model III ROM	Clock: Day (01-31). POKEable.
421CH ↳16924 ↳TICKIT+6	Model III ROM, T3	Single byte at 421Ch holding the current MONTH (1–12) of the real-time clock date. Part of the TICKIT block: 421Ah = year, 421Bh = day, 421Ch = month.
421DH ↳16925 ↳ROUDCB	Model III ROM	Start of the RS-232 Output-used Device Control Block (8 bytes at 421Dh). This DCB is used for actual RS-232 character output in certain contexts distinct from the main RODCB at 41EDh.

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
421FH ↳16927	N1	NEWDOS/80: Store calculated value to 421FH (GAT size in buffer).

Model III System Variables and Cassette Data (4201H-4224H)

Address (Hex/Dec/Label)	Source	Description
4220H-4221H ↳16928	Both Model I and III ROM	$ROUTE destination device name (2 bytes).
4222H-4223H ↳16930	Model III ROM	I/O Router DCB: Source device name (2 bytes).
4224H ↳16932 ↳CNTFLG	Model III ROM	Single byte at 4224h: the Control-key flag. Holds FFh if no Control-key modifier is active, or 1Fh if the Control key (Left Shift + Down Arrow combination on the Model III) is currently pressed. Programs can read CNTFLG via PEEK 4224h to test whether the Control key is being held.

TRSDOS 1.3 SYS0 System Workspace (4225H-42FFH)

Address (Hex/Dec/Label)	Source	Description
4225H-4264H ↳16933 ↳COMAND	Model III ROM, T3	64-byte command line input buffer

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4234H ↳16948	N1	NEWDOS/80: If there are still bytes to read (meaning Register C did not yet hit 0), JUMP to 4234H.
423BH ↳16955	N1	NEWDOS/80: LOOP back to 423BH, reducing Register B each time, and continue to LOOP until Register B has been reduced to ZERO, in which case, continue with the next instruction.
4240H ↳16960	N1	NEWDOS/80: JUMP to 4240H, reducing Register B each time, and continue to LOOP until Register B has been reduced to ZERO, in which case, continue with the next instruction.
424CH ↳16972	N1	NEWDOS/80: If the byte was GREATER THAN 1FH then we know already that there is no DOS present, so JUMP to 424CH to display the "NO SYS" error message and freeze the system.
4252H ↳16978	N1	NEWDOS/80: GOSUB to 4252H to bump to the next byte of the RAM BUFFER and then fetch the byte into Register A.
4255H ↳16981	N1	NEWDOS/80: If the BUFFER POINTER has just rolled over, then GOSUB to 4255H to read another sector into the RAM BUFFER.
4258H ↳16984	N1	NEWDOS/80: LOOP back to 4258H, reducing Register B each time, and continue to LOOP until Register B has been reduced to ZERO, in which case, continue with the next instruction.

TRSDOS 1.3 SYS0 System Workspace (4225H-42FFH)

Address (Hex/Dec/Label)	Source	Description
4265H-426CH ↳16997 ↳MIKE1	Model III ROM, T3	8-byte work area

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4267H ↳16999	N1	NEWDOS/80: If the Carry Flag is set, then the sector number is too high! JUMP to 4267H.

TRSDOS 1.3 SYS0 System Workspace (4225H-42FFH)

Address (Hex/Dec/Label)	Source	Description
426DH-426EH ↳17005 ↳BASICF	Model III ROM, T3	BASIC pointer storage (2 bytes)
426FH-4270H ↳17007 ↳PROSAV	Model III ROM, T3	BASIC protection save (2 bytes)
4271H ↳17009 ↳D10SAV	Model III ROM, T3	Drive save area for SYS10 (1 byte, initialized to 0)
4272H-4273H ↳17010 ↳BASIC1	Model III ROM, T3	BASIC general purpose save area 1 (2 bytes)
4274H-4275H ↳17012 ↳BASIC2	Model III ROM, T3	BASIC general purpose save area 2 (2 bytes)
4276H-4277H ↳17014 ↳BASIC3	Model III ROM, T3	BASIC general purpose save area 3 (2 bytes)
4278H-4279H ↳17016 ↳BASIC4	Model III ROM, T3	BASIC general purpose save area 4 (2 bytes)
427AH ↳17018 ↳BASICG	Model III ROM, T3	Flag: FFH = BASIC not running, 00H = BASIC is running

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
427BH ↳17019 ↳SYSS10	Model III ROM, T3	BASIC error handler overlay vector (DO 10,10)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
427EH ↳17022	N1	NEWDOS/80: Load Register A with the drive number from 427EH.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
427EH ↳17022 ↳SSYS12	Model III ROM, T3	BASIC renumber overlay vector (DO 00,12)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4280H ↳17024	N1	NEWDOS/80: Point Index Register IY to 4280H, the DOS system parameter block base address. This provides quick access to drive parameters and system state through indexed addressing throughout the ATTRIB command handler.
4281H ↳17025	N1	NEWDOS/80: If Parity Odd (odd number of bits set in result), JUMP to 4281H - ROM error handler. This detects abnormal FDC states.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
4281H ↳17025 ↳SYSS12	Model III ROM, T3	BASIC compress function overlay vector (DO 10,12)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4283H ↳17027	N1	NEWDOS/80: Load Register A with the disk name pointer from DOS parameter area 4283H.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
4284H ↳17028 ↳SSYS13	Model III ROM, T3	BASIC sort function overlay vector (DO 00,13)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4287H ↳17031	N1	NEWDOS/80: If NZ FLAG (DRQ active), JUMP to 4287H - ROM routine to handle rapid data transfer.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
4287H ↳17031 ↳SYSS13	Model III ROM, T3	BASIC Julian date function overlay vector (DO 10,13)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4288H ↳17032	N1	NEWDOS/80: Store the value held in Register A (00H) into memory location 4288H. This clears a system flag or state byte.
4289H ↳17033	N1	NEWDOS/80: Load Register Pair BC with the 16-bit value stored at memory location 4289H (low byte) and 428AH (high byte). These are DOS system flag bytes that control various operational modes.
428AH ↳17034	N1	NEWDOS/80: If drive is READY, JUMP to 428AH.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
428AH ↳17034 ↳SSSY13	Model III ROM, T3	BASIC cross-reference function overlay vector (DO 20,13)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
428BH ↳17035	N1	NEWDOS/80: Load Register A with the system flags byte at 428BH.
428CH ↳17036	N1	NEWDOS/80: Load Register A with the system flags byte from 428CH.
428DH ↳17037	N1	NEWDOS/80: Fetch the byte stored at memory location 428DH and load it into Register A. This is the system state flags byte.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
428DH ↳17037 ↳SSYS14	Model III ROM, T3	USER: return LFN and drive overlay vector (DO 00,14)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4290H ↳17040	N1	NEWDOS/80: Load Register A with the upper display limit from 4290H.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
4290H ↳17040 ↳SSSY14	Model III ROM, T3	USER: return directory to RAM overlay vector (DO 10,14)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4291H ↳17041	N1	NEWDOS/80: Point DE to 4291H, the destination - active drive parameter area.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
4293H ↳17043 ↳SSYS15	Model III ROM, T3	Spare/undefined overlay vector (DO 00,15)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4296H ↳17046	N1	NEWDOS/80: Load HL with 4296H - address of default drive number in system area.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
4296H ↳17046 ↳S1RST1	Model III ROM, T3	DOS re-entry overlay vector (DO 10,1)
4299H ↳17049 ↳S1RST2	Model III ROM, T3	Command to DOS, no return (DO 30,1). HL => command string.
429CH ↳17052 ↳S1RST7	Model III ROM, T3	Command to DOS with return (DO 70,1). HL => command string.
429FH ↳17055 ↳FORMAT	Model III ROM, T3	Disk format overlay vector (DO 20,7)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
42A0H ↳17056	N1	NEWDOS/80: Fetch drive count from boot sector.
42A1H ↳17057	N1	NEWDOS/80: Fetch step rate from boot sector.
42A2H ↳17058	N1	NEWDOS/80: Fetch parameter from boot sector.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
42A2H ↳17058 ↳BACKUP	Model III ROM, T3	Disk backup overlay vector (DO 10,7)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
42A3H ↳17059	N1	NEWDOS/80: Fetch parameter from boot sector.
42A4H ↳17060	N1	NEWDOS/80: If the drive is BUSY, JUMP to 42A4H.
42A5H ↳17061	N1	NEWDOS/80: Fetch system parameter.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
42A5H ↳17061 ↳SSYS8	Model III ROM, T3	HELP command overlay vector (DO 10,8)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
42A6H ↳17062	N1	NEWDOS/80: Fetch parameter from boot sector.
42A7H ↳17063	N1	NEWDOS/80: Fetch keyboard parameter.
42A8H ↳17064	N1	NEWDOS/80: Fetch disk parameter.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
42A8H ↳17064 ↳SSYS9	Model III ROM, T3	Library commands part 2 overlay vector (DO 10,9)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
42A9H ↳17065	N1	NEWDOS/80: Fetch delay value from boot sector.

TRSDOS 1.3 SYS0 Overlay Vectors (427BH-42ADH)

Address (Hex/Dec/Label)	Source	Description
42ABH ↳17067 ↳SSYS11	Model III ROM, T3	Library commands part 3 overlay vector (DO 10,11)

TRSDOS 1.3 SYS0 System Flags and Control (42AEH-42FFH)

Address (Hex/Dec/Label)	Source	Description
42AEH ↳17070 ↳BREAK	Model III ROM, T3	Break key kill vector (JP KILBRK). Patched to C9H=RET to activate break key.
42B1H-42B2H ↳17073 ↳GOSAVE	Model III ROM, T3	DO command save address (initialized to KEYBDZ)
42B3H ↳17075 ↳DIFULT	Model III ROM, T3	Master/default drive number (1 byte, initialized to 0)
42B4H ↳17076 ↳CFLAG	Model III ROM, T3	Flag: 55H = clear user memory on next command entry
42B5H-42B6H ↳17077 ↳INITD	Model III ROM, T3	Flag: DOS has been initialized (2 bytes)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
42B6H ↳17078	N1	NEWDOS/80: If the NZ FLAG (Not Zero) has been set, JUMP to 42B6H to skip over incrementing the track.

TRSDOS 1.3 SYS0 System Flags and Control (42AEH-42FFH)

Address (Hex/Dec/Label)	Source	Description
42B7H-42B9H ↳17079 ↳DTSAVE	Model III ROM, T3	User date save area (3 bytes: MM/DD/YY)

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
42B9H ↳17081	N1	NEWDOS/80: If any of that stuff is true then that's a bad thing ... JUMP to 42B9H to wait for the Floppy Drive Controller to be ready, send a RESET to the FDC, and continue a countdown of retries; failing to DISK ERROR if the retry count expires.

TRSDOS 1.3 SYS0 System Flags and Control (42AEH-42FFH)

Address (Hex/Dec/Label)	Source	Description
42BAH ↳17082 ↳UTIL	Model III ROM, T3	Library commands part 1 overlay vector (DO 00,6)
42BDH ↳17085 ↳RETX	Model III ROM, T3	NMI return instruction (RETN) when no disk I/O in progress

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
42C0H ↳17088	N1	NEWDOS/80: Load Register A with the default drive number from the DOS parameter area at 42C0H.
42C3H ↳17091	N1	NEWDOS/80: LOOP back to the top of this routine (i.e., 42C3H) to either keep displaying message letters or be in an endless loop.
42C5H ↳17093	N1	NEWDOS/80: Store the value held in Register A (00H) into memory location 42C5H. This clears the saved character flag used during chaining operations.
42C9H ↳17097	N1	NEWDOS/80: Load Register Pair HL with the 16-bit value at 42C9H - the actual top of available RAM detected at boot.
42CBH ↳17099	N1	NEWDOS/80: Load DE with 42CBH - destination in sector buffer.
42CEH ↳17102	N1	NEWDOS/80: GOSUB to 42CEH to wait until the Floppy Disk Controller signals READY.
42D0H ↳17104	N1	NEWDOS/80: Load DE with 42D0H, the destination address in the DOS work area.
42D1H ↳17105	N1	NEWDOS/80: If a command is in progress (and the NZ FLAG has been set as a result), JUMP BACK one instruction to 42D1H and test again.
42D7H ↳17111	N1	NEWDOS/80: GOSUB to 42D7H for a VERY short delay to wait for the Floppy Disk Controller to be ready.
42D8H ↳17112	N1	NEWDOS/80: Load HL with 42D8H - disk date in sector buffer.
42D9H ↳17113	N1	NEWDOS/80: If the NZ FLAG (Not Zero) has been set, LOOP BACK to the prior instruction.
42DDH ↳17117	N1	NEWDOS/80: If we fall through then we have an error, so let Register Pair HL equal 42DDH to point to the message "DISK ERROR".
42E0H ↳17120	N1	NEWDOS/80: Point HL to buffer data.
42E5H-43E8H ↳17125 ↳BUFINI-3	Model III ROM	RAM address three bytes before the start of the keyboard input buffer initialization area (BUFINI is at 43E8h, and 42E5h = 43E8h − 3 in the Model III; note the label offset refers to Model I geometry but the actual address 42E5h is used).
42E8H ↳17128 ↳ENBINI / TSTACK	T1	End-of-RAM test marker / always zero. End of Model I system variable area.
42E9H ↳17129	Both Model I and III ROM, T1	Start of user RAM for BASIC program storage (non-DOS).
42EFH ↳17135	N1	NEWDOS/80: Fetch DOS signature byte from boot sector.
42F0H ↳17136	N1	NEWDOS/80: Fetch word from 42F0H.
42F2H ↳17138	N1	NEWDOS/80: Fetch word from 42F2H.
42F8H ↳17144 ↳BUFINI+20	Model III ROM	Temporary stack pointer used during BASIC initialization, set to 42F8h (BUFINI+20 in Model III layout). This is a transient stack used only during the initialization sequence; the final stack top (STKTOP) is computed separately and stored to 40A0h. Using 42F8h places the init stack safely in the communications RAM buffer area.
42F9H ↳17145	N1	NEWDOS/80: Fetch more boot options.
42FAH ↳17146	N1	NEWDOS/80: Fetch system options from boot sector.
42FDH ↳17149	N1	NEWDOS/80: Fetch another boot parameter.
42FEH ↳17150	N1	NEWDOS/80: Fetch boot sector parameters from 42FEH.
42FFH ↳17151	N1, T3	NEWDOS/80: Load DE with 42FFH (disk buffer end).

TRSDOS 1.3 SYS0 System Flags and Control (42AEH-42FFH)

Address (Hex/Dec/Label)	Source	Description
42FFH ↳17151 ↳SCAFLG	Model III ROM, T3	System/SCA flag byte

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4300H ↳17152	T1, N1	TRSDOS 2.3 DOS work area base. The DOS workspace begins immediately after the directory sector buffer and extends through 43FFH.

TRSDOS 1.3 SYS0 Disk Buffers (4300H-4DFFH)

Address (Hex/Dec/Label)	Source	Description
4300H-43FFH ↳17152 ↳BUFF1	Model III ROM, T3	First 256-byte disk I/O buffer

Boot, Stack, and Buffer Workspace (42E5H-43E8H)

Address (Hex/Dec/Label)	Source	Description
4302H ↳17154	N1	NEWDOS/80: Store 00H to drive 0's flags at 4302H to signal warning condition.
4304H ↳17156	T1	TRSDOS 2.3: track cache table (4 bytes, 4304H–4307H). One byte per drive (drives 0–3), holding the track number of the most recently seeked track. Used by the Drive Select routine at 4600H to avoid redundant seeks.
4308H ↳17160	N1	NEWDOS/80: Point HL to current drive number storage.
4309H ↳17161	N1	NEWDOS/80: Store drive select mask (01H, 02H, 04H, or 08H depending on drive).
430AH ↳17162	T1, N1	TRSDOS 2.3: saved FCB pointer during overlay calls (2 bytes). The SYS0 overlay loader at 4BA2H saves the current FCB pointer here before dispatching to a disk overlay, then restores it on return.
430CH ↳17164	T1, N1	TRSDOS 2.3: saved overlay return address (2 bytes). Holds the caller's return address across RST 28H overlay calls. Restored by the overlay loader at 4BA2H after the overlay completes.
430DH ↳17165	N1	NEWDOS/80: Point HL to 430DH, the first drive's TI field (offset +0DH from 4300H).
430EH ↳17166	T1, N1	TRSDOS 2.3: currently loaded overlay ID (1 byte). Contains the SVC code of the overlay currently resident in the 4E00H area. Used by the overlay loader at 4BA2H to avoid reloading an already-cached overlay.
430FH ↳17167	T1, N1	TRSDOS 2.3: system mode flags (1 byte). Bit 7 = DEBUG active; Bit 6 = TRACE active; Bit 5 = command mode; Bit 4 = SYS6 cached. Written by the DEBUG command handler at 5162H and the TRACE command handler at 5191H.
4310H ↳17168	N1	NEWDOS/80: Fetch the desired sector number from memory location 4310H.
4311H ↳17169	N1	NEWDOS/80: Load A with system flags from 4311H. Bits 0-1 indicate CPU speed: 00=1.77MHz, 01=2.03MHz, 10=4MHz.
4312H ↳17170	T1, N1	TRSDOS 2.3: SYS0 vector for "return on Z or JP to nnnn" (3 bytes). A JP nnnn instruction patched by SYS0; used as the return path from certain SVC calls. Referenced from BASIC/CMD at 5D4DH.
4313H ↳17171	T1, N1	TRSDOS 2.3: address operand of the 4312H return vector (2 bytes). Self-modified at runtime by BASIC/CMD: LD (4313H),HL stores the target jump address.
4315H ↳17173	T1	TRSDOS 2.3: BREAK key handler opcode (1 byte). C3H (JP) when BREAK is enabled (BREAK active); 00H or NOP when disabled. Written by the BREAK command and the DEBUG toggle. Also used as the BREAK enable flag by the DOS command loop.
4316H ↳17174	T1	TRSDOS 2.3: BREAK key handler target address (2 bytes). Contains the address of the BREAK handler routine. Patched by SYS1 at startup and by the DEBUG command when toggling break mode.
4317H ↳17175	N1	NEWDOS/80: Point HL to the current active device code storage location at 4317H (cached last-used device).
4318H-4337H ↳17176	T1, N1	TRSDOS 2.3: DOS command input buffer (32 bytes, 4318H–4337H). Filled by the command input routine at 4E1FH. Parsed by the command line parser/dispatcher at 4E4EH (SYS1 request code 30H).
431FH ↳17183	N1	NEWDOS/80: Load Register A with the value at 431FH - number of granules per file or system parameter.
434CH ↳17228	N1	NEWDOS/80: DATA: Bytes FC 4C 43 - Handler address (434CH, but FC is parsed as part of flags context).
4358H-43B7H ↳17240	T1	TRSDOS 2.3: drive parameter table (32 bytes per drive × 4 drives, 4358H–43B7H). Each 32-byte slot holds 8 bytes of drive parameters (copied from the boot sector data at 4015H), 8 bytes of drive status, and 16 bytes of FFH padding. Indexed by drive number (0–3).
4359H ↳17241	T1	TRSDOS 2.3: system condition flags within the drive parameter table (1 byte). Bit 5 is tested during DOS READY initialization at 4E1FH.
4369H ↳17257	N1	NEWDOS/80: Point HL to the driver/output status flags byte at 4369H (bit 6 is the "operation in progress" semaphore shared with the interrupt handler at 45F2H).
436AH ↳17258	N1	NEWDOS/80: Point Register Pair HL to the DOS system flags byte at 436AH (part of SYSTEM storage area 4368H-4370H).Bit 7 = MINI-DOS activeBit 6 = DOS-CALL activeBit 5 = command processing stateBit 4 = additional state flag
436BH ↳17259	N1	NEWDOS/80: Point Register Pair HL to address 436BH, a DOS system storage byte.Bit 7 = special return modeBit 6 = stack save modeBit 2 = error state
436CH ↳17260	N1	NEWDOS/80: Load Register A with the DOS flags from 436CH. Bit 7 indicates if disk I/O is allowed.
436DH ↳17261	N1	NEWDOS/80: Load Register A with the value from 436DH, a DOS system flag byte.Bit 5 = R command repeat flag
436EH ↳17262	N1	NEWDOS/80: Store at 436EH - extended flags.
4370H ↳17264	N1	NEWDOS/80: Point Register Pair HL to 4370H in the SYS0 area, which contains the disk parameter from boot sector or maximum allowed character code.
4371H ↳17265	N1	NEWDOS/80: Point DE to drive parameter table.
4380H ↳17280	N1	NEWDOS/80: Point Index Register IY to 4380H, the base of the DOS system data area. This provides access to drive parameter blocks and system configuration data throughout the routine.
4399H ↳17305	N1	NEWDOS/80: Load Register HL with the contents of system buffer pointer at 4399H (SYS0 data area). This is the destination/source for the copy operation.
439BH ↳17307	N1	NEWDOS/80: Store the current stack pointer into 439BH (DOS storage area). This saves the exact stack position so we can return to the interrupted program later.
439DH ↳17309	N1	NEWDOS/80: Store the current Stack Pointer into 439DH. This saves the DOS-CALL entry point for later restoration.
439FH ↳17311	N1	NEWDOS/80: Store at 439FH - max drive number.
43A0H ↳17312	N1	NEWDOS/80: Point HL to the first system parameter at 43A0H (the drive count setting).
43A1H ↳17313	N1	NEWDOS/80: Fetch default drive number from 43A1H (system variable).
43A2H ↳17314	N1	NEWDOS/80: Store at 43A2H.
43A4H ↳17316	N1	NEWDOS/80: Store 0 into 43A4H, clearing the flag that controls special memory display mode.
43A7H ↳17319	N1	NEWDOS/80: Store the command buffer start address at 43A7H for reference by the R (recall) command.
43A9H ↳17321	N1	NEWDOS/80: Fetch the 16-bit value stored at memory location 43A9H (high memory address pointer from SYS0) into Register Pair HL. This is the detected top of RAM.
43ABH ↳17323	N1	NEWDOS/80: Point HL to warm boot signature location.
43ACH ↳17324	N1	NEWDOS/80: Point DE to backup/restore area at 43ACH.
43AFH ↳17327	N1	NEWDOS/80: Point Register Pair HL to 43AFH, which is near the start of the device driver chain storage area in the DOS system data region.
43B2H ↳17330	N1	NEWDOS/80: Point HL to driver chain.
43B8H-43C9H ↳17336	T1	TRSDOS 2.3: boot sector parameter copies (18 bytes, 43B8H–43C9H). Copies of key parameters from the boot sector (track counts, sector counts, step rate) saved here by the boot continuation routine at 4E23H.
43CCH-43FFH ↳17356	T1	TRSDOS 2.3: general work area (52 bytes, 43CCH–43FFH). Cleared to zero during boot initialization at 4E23H. Used as scratch space by various DOS routines.
43CEH ↳17358	N1	NEWDOS/80: Store DE (filename hash/directory entry pointer) at 43CEH - the directory entry pointer variable.
43D0H ↳17360	N1	NEWDOS/80: Load Register Pair DE with 43D0H - destination address for name data (primary location).
43D1H ↳17361	N1	NEWDOS/80: Data bytes.
43D8H ↳17368	T1, N1	TRSDOS 2.3 DOS READY entry point. The command prompt dispatcher. Enables interrupts, resets the stack to 41FCH, displays the `DOS READY` prompt, and enters the command input loop. Equivalent to SYS1 request code 20H. Callable from BASIC via CMD"S".
43DCH ↳17372	N1	NEWDOS/80: Store the resolved driver address into the cache at 43DCH for future reuse.
43E8H ↳17384 ↳ENBINI	Model III ROM	Start of the keyboard input buffer area (BUFINI) at 43E8h. This is the boundary address that separates the BASIC system working stack (below) from the keyboard input buffer (at and above 43E8h). The buffer pointer BUFPNT (40A7h) is set to 42E8h (three bytes above 42E5h) during init, meaning the actual usable input buffer starts below 43E8h for the Model III layout.
43F0H ↳17392	N1	NEWDOS/80: Point HL to the boolean flag storage table at 43F0H.

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
4400H ↳17408	T1, N1	TRSDOS 2.3 SVC Jump Table entry: DOS READY (3 bytes). JP 43D8H. RST 28H SVC code dispatch entry for the DOS READY command prompt. This is also the main DOS entry point for programs returning to DOS.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
4400H ↳17408 ↳DELLY	Model III ROM, T3	Long delay routine: 8 PUSH AF/POP AF pairs then RET
4404H ↳17412 ↳SDELAY	Model III ROM, T3	Short delay routine: 4 PUSH AF/POP AF pairs then RET

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
4405H ↳17413	T1, N1	TRSDOS 2.3 SVC Jump Table entry: Cold Boot / Initialize (3 bytes). JP 4E00H. Calls the cold boot initialization routine at 4E00H.
4409H ↳17417	T1, N1, T3	TRSDOS 2.3 SVC Jump Table entry: Read Sector (3 bytes). SVC code for physical disk read operations via SYS0.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
4409H ↳17417 ↳ERROR	Model III ROM, T3	Error handler: PUSH AF then loads SYS4 overlay (DO 00,4)

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
440DH ↳17421	T1, N1	TRSDOS 2.3 SVC Jump Table entry: Write Sector (3 bytes). SVC code for physical disk write operations via SYS0.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
440DH ↳17421 ↳DEBUG	Model III ROM, T3	Debug entry: PUSH AF then loads SYS5 overlay (DO 00,5)

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
4411H ↳17425	T1, N1, T3	TRSDOS 2.3 SVC Jump Table entry: Memory Size Query (3 bytes). Returns DOS memory size (from 4049H) in HL.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
440DH-440EH ↳17425 ↳MEMEND	Model III ROM, T3	End of user memory pointer (2 bytes, default 7FFFH)
4413H ↳17427 ↳MAXDRV	Model III ROM, T3	Number of disk drives in system (1 byte)
4414H ↳17428 ↳FLAG1	Model III ROM, T3	Last system overlay number loaded (1 byte)
4411H-4412H ↳17429 ↳MEM2	Model III ROM, T3	Mirror of MEMEND end-of-memory pointer (2 bytes)
4413H-4414H ↳17431 ↳DATA3	Model III ROM, T3	Start of user RAM pointer (default 5200H = SYSHI)
4419H ↳17433 ↳SSYS10	Model III ROM, T3	BASIC directory command overlay vector (DO 00,10)

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
441CH ↳17436	T1	TRSDOS 2.3 SVC Jump Table entry: Parse Filename into DCB (3 bytes). SVC code 4 via SYS1 request 40H: copies and validates a filename from the command line into the specified Device Control Block.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
441CH ↳17436 ↳SYNTAX	Model III ROM, T3	Filespec syntax parser overlay vector (DO 40,1)
441FH ↳17439 ↳CURDOS	Model III ROM, T3	DOS version byte: 13H indicates TRSDOS version 1.3. BASIC checks this.

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
4420H ↳17440	T1, N1	TRSDOS 2.3 SVC Jump Table entry: Execute Program (3 bytes). Load and execute a program file. Calls SYS0 program loader at 4C06H.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
4420H ↳17440 ↳INIT	Model III ROM, T3	Initialize/open new file overlay vector (DO 20,2)
4423H ↳17443 ↳DRIVE	Model III ROM, T3	Current drive select bit pattern (1 byte)

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
4424H ↳17444	T1, N1	TRSDOS 2.3 SVC Jump Table entry: Open Existing File (3 bytes). Calls SYS2 (Open File overlay, SVC code A0H) to search the directory for a matching entry and populate the FCB.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
4424H ↳17444 ↳OPEN	Model III ROM, T3	Open existing file overlay vector (DO 10,2)
4427H ↳17447 ↳CURDRV	Model III ROM, T3	Current drive number in use (1 byte, 0-3)

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
4428H ↳17448	T1, N1	TRSDOS 2.3 SVC Jump Table entry: Close File (3 bytes). Calls SYS3 (Close File overlay, SVC code 95H) to write EOF and extent data back to the directory and deallocate unused granules.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
4428H ↳17448 ↳CLOSE	Model III ROM, T3	Close a file overlay vector (DO 10,3)
442BH ↳17451 ↳OVLFLG	Model III ROM, T3	Overlay-in-progress flag (1 byte)

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
442CH ↳17452	T1, N1	TRSDOS 2.3 SVC Jump Table entry: Kill File (3 bytes). Calls SYS3 (Kill File overlay, SVC code A5H) to deallocate all granules and clear the directory entry.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
442CH ↳17452 ↳KILL	Model III ROM, T3	Kill a file entry point (JP KILFIL)
442FH ↳17455 ↳DULFLG	Model III ROM, T3	Dual drive mode on/off flag (1 byte)
4430H ↳17456 ↳LDPGM	Model III ROM, T3	Load program into RAM entry point (JP LDPGM1)

Disk BASIC Entry Points / Driver Vector Table (4152H–41E4H)

Address (Hex/Dec/Label)	Source	Description
4433H ↳17459 ↳EXEC	T3	TRSDOS 1.3: EXEC — DOS program executor entry point. Loads a program from disk and transfers control to it. Only Register Pair HL survives the call. Referenced by the SYS01/SYS command interpreter when a command is not found in the LIBCOM table.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
4433H ↳17459 ↳EXEC	Model III ROM, T3	Load and execute program entry point (JP EXPGM1)

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
4436H ↳17462	T1, N1	TRSDOS 2.3 SVC Jump Table entry: Seek / Position to Record (3 bytes). Calls SYS0 Position to Record routine at 4737H.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
4436H ↳17462 ↳READ	Model III ROM, T3	Read a record entry point (JP READ1)

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
4437H ↳17463	T1	TRSDOS 2.3 SVC Jump Table entry: Read Record (3 bytes). JP 476DH. Reads one logical record from the current file position.
4439H ↳17465	T1, N1	TRSDOS 2.3 SVC Jump Table entry: Write Record (3 bytes). Calls SYS0 Write Record routine at 478BH.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
4439H ↳17465 ↳WRITE	Model III ROM, T3	Write without verify entry point (JP WRITE1)
443CH ↳17468 ↳VERF	Model III ROM, T3	Write with verify entry point (JP WRITE1)
443FH ↳17471 ↳REWIND	Model III ROM, T3	Rewind file to beginning entry point (JP REW)

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
4442H ↳17474	T1	TRSDOS 2.3 SVC Jump Table entry: Rewind File (3 bytes). Calls SYS0 Rewind File routine at 4756H to reset the file position to BOF.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
4442H ↳17474 ↳POSN	Model III ROM, T3	Position file to record N entry point (JP POSN1)

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
4445H ↳17477	T1, N1	TRSDOS 2.3 SVC Jump Table entry: Open/Create and Load (3 bytes). Opens an existing file or creates a new one with initial granule allocation; then loads the program. Calls SYS2 request 30H at 4F50H.

TRSDOS 1.3 SYS0 User Disk Jump Table (4400H-4456H)

Address (Hex/Dec/Label)	Source	Description
4445H ↳17477 ↳BACKSP	Model III ROM, T3	Backspace one record entry point (JP BKSP)
4448H ↳17480 ↳POSEOF	Model III ROM, T3	Position to end of file entry point (JP PEOF)
444BH ↳17483 ↳PUTEXT	Model III ROM, T3	Add extension to filespec overlay vector (DO 50,1)
444EH ↳17486 ↳MULT	Model III ROM, T3	16-bit unsigned multiply entry point (JP DMULT)
4451H ↳17489 ↳DIV	Model III ROM, T3	16-bit unsigned divide entry point (JP DIVIDE)
4454H ↳17492 ↳SWITCH	Model III ROM, T3	Table comparison/switch routine overlay vector (DO 60,1)

TRSDOS 1.3 SYS0 System DCB and Saves (4457H-44ACH)

Address (Hex/Dec/Label)	Source	Description
4453H-4456H ↳17495 ↳DIRTRK	Model III ROM, T3	Directory track number table (4 bytes, one per drive, all initialized to 17)
4457H-445EH ↳17499 ↳SEKTRK	Model III ROM, T3	Last-track-used table (8 bytes: 4 drives x 2 sides, all initialized to 0)
4463H ↳17507 ↳CSIDE	Model III ROM, T3	Current disk side to read/write from/to (1 byte, 0 or 1). Defined in SYS0 at 4463H and referenced across overlays: SYS3 (CLOSE/KILL) writes it before every GAT read/write, directory read/write, and HIT read/write to ensure the correct side is selected; SYS5 (DEBUG monitor) clears it to 0 via the QUIT command before returning to DOS.
4464H ↳17508 ↳OLDSID	Model III ROM, T3	Previous side used (0 or 1)

Disk BASIC Entry Points / Driver Vector Table (4152H–41E4H)

Address (Hex/Dec/Label)	Source	Description
4465H ↳17509 ↳DCB	T3	TRSDOS 1.3: DCB — Device Control Block buffer used by the SYS01/SYS command interpreter for filespec storage during command parsing. CALCOM points DE here before calling FSPEC.

TRSDOS 1.3 SYS0 System DCB and Saves (4457H-44ACH)

Address (Hex/Dec/Label)	Source	Description
4461H-4496H ↳17509 ↳DCB	Model III ROM, T3	System DCB (50 bytes). Initialized to 'FILENAME/EXT.PASSWORD:D' template.

TRSDOS 2.3 SVC Jump Table (4400H–4445H)

Address (Hex/Dec/Label)	Source	Description
4467H ↳17511	T1, N1	DOS string output dispatch entry point. Called with HL pointing to a string terminated by 0DH (CR) or 03H (ETX). T1 (TRSDOS 2.3): JP to 44CFH — loops calling RST 33H (video character output) for each byte until 0DH. N1 (NEWDOS/80 v2.0): JP to 4BA6H — loops calling RST 1BH (device character output via DCB at 401DH) until 0DH or 03H. Called from the command-line dispatcher to display command responses and error messages.

TRSDOS 2.3 Overlay and SYS1 Work Area (44A1H–5026H)

Address (Hex/Dec/Label)	Source	Description
4480H-449FH ↳17536	T1, N1	TRSDOS 2.3 SYS1: parsed filespec buffer (32 bytes, 4480H–449FH). Populated by the filespec parser at 4F56H (SYS1 request code 50H). Holds the structured NAME/EXT.PASSWORD:DRIVE filespec after parsing.

TRSDOS 1.3 SYS0 System DCB and Saves (4457H-44ACH)

Address (Hex/Dec/Label)	Source	Description
4497H ↳17559 ↳MDCB	Model III ROM, T3	Internal system files DCB start (MTYPE byte, initialized to 80H=disk type)
4497H ↳17559 ↳MTYPE	T3	Internal (system files) DCB device-type byte (1 byte, initialized to 80H = disk type).
4498H ↳17560 ↳MPROT	T3	Internal system DCB protection level and status bits (1 byte).
449AH-449BH ↳17562 ↳MBUFF	Model III ROM, T3	System DCB buffer pointer (initialized to BUFF2=4D00H)
449CH ↳17564 ↳MOFF	T3	Internal system DCB byte offset inside sector (1 byte).
449DH ↳17565 ↳MDRV	T3	Internal system DCB drive number (1 byte).
449EH ↳17566 ↳MLFN	T3	Internal system DCB logical file number (1 byte).
449FH ↳17567 ↳MEOF	T3	Internal system DCB end-of-file byte (1 byte).
44A0H ↳17568 ↳MLRL	T3	Internal system DCB logical record length (1 byte, 0 = 256).

TRSDOS 2.3 Overlay and SYS1 Work Area (44A1H–5026H)

Address (Hex/Dec/Label)	Source	Description
44A1H ↳17569	T1, N1	TRSDOS 2.3: overlay execution state flag (1 byte). Indicates whether an overlay is currently executing. Tested by the overlay loader at 4BA2H before loading a new overlay.

TRSDOS 1.3 SYS0 System DCB and Saves (4457H-44ACH)

Address (Hex/Dec/Label)	Source	Description
44A1H ↳17569 ↳MNRN	T3	Internal system DCB next record number (2 bytes).
44A3H ↳17571 ↳MERN	T3	Internal system DCB ending record number (2 bytes, initialized to -1 = FFFFH).
44A5H ↳17573 ↳MSIDE	T3	Internal system DCB side number (1 byte).
44A6H ↳17574 ↳MSPAR	T3	Internal system DCB spare byte (1 byte).

TRSDOS 2.3 Overlay and SYS1 Work Area (44A1H–5026H)

Address (Hex/Dec/Label)	Source	Description
44A7H ↳17575	T1, N1	TRSDOS 2.3: overlay directory entry info byte (1 byte). Holds directory entry metadata for the currently cached overlay file. Used by the overlay loader to identify the active overlay.

TRSDOS 1.3 SYS0 System DCB and Saves (4457H-44ACH)

Address (Hex/Dec/Label)	Source	Description
44A7H ↳17575 ↳MEXT	T3	Internal system DCB segment descriptors start (2 bytes).
44A9H-44AAH ↳17577 ↳SAVE2	Model III ROM, T3	Temporary storage: caller return address for SAVER routine

TRSDOS 2.3 Overlay and SYS1 Work Area (44A1H–5026H)

Address (Hex/Dec/Label)	Source	Description
44AAH-44ABH ↳17578	T1	TRSDOS 2.3: overlay cache markers (2 bytes, 44AAH–44ABH). Set to 0000H when the overlay cache is invalidated. Compared by the overlay loader at 4BA2H to avoid reloading.

TRSDOS 1.3 SYS0 System DCB and Saves (4457H-44ACH)

Address (Hex/Dec/Label)	Source	Description
44ABH-44ACH ↳17579 ↳SAVE3	Model III ROM, T3	Temporary storage: DCB pointer for SAVER routine

TRSDOS 2.3 Overlay and SYS1 Work Area (44A1H–5026H)

Address (Hex/Dec/Label)	Source	Description
44AEH-44AFH ↳17582	T1, N1	TRSDOS 2.3: overlay starting sector address on disk (2 bytes, 44AEH–44AFH). Set when the overlay directory entry is located; used by the overlay loader to read the overlay file from disk.

TRSDOS 1.3 SYS0 System DCB and Saves (4457H-44ACH)

Address (Hex/Dec/Label)	Source	Description
45B8H ↳17848 ↳READIT	T3	TRSDOS 1.3 SYS0 resident: READ-with-retry subroutine. Calls READ (4436H) and automatically retries on certain recoverable disk errors. Used by SYS6 and other overlays for robust I/O.
45F7H ↳17911 ↳XWRITE	T3	TRSDOS 1.3 SYS0 resident: WRITE-with-retry subroutine. Calls WRITE (4439H) and automatically retries on certain recoverable disk errors. Used by SYS6 S6PROT for directory sector writes.
4A67H ↳19047 ↳RDDIR	T3	TRSDOS 1.3 SYS0 resident: Read Directory sector. On entry, Register C holds the drive number. Reads the current directory track/sector for that drive into the BUFF1 buffer at 4300H. Returns Z on success, NZ with error code in A on failure.
4A7BH ↳19067 ↳WRDIR	T3	TRSDOS 1.3 SYS0 resident: Write Directory sector. On entry, Register C holds the drive number. Writes the current directory sector from BUFF1 at 4300H back to disk. Returns Z on success, NZ with error code on failure.
4A93H ↳19091 ↳RDGAT	T3	TRSDOS 1.3 SYS0 resident: Read Granule Allocation Table. On entry, Register C holds the drive number. Reads the GAT sector (track 0 sector 1) for that drive into the BUFF2 buffer at 4D00H. Returns Z on success, NZ with error code on failure.
4A9BH ↳19099 ↳WRGAT	T3	TRSDOS 1.3 SYS0 resident: Write Granule Allocation Table. On entry, Register C holds the drive number. Writes the GAT from BUFF2 at 4D00H back to disk. Returns Z on success, NZ with error code on failure.
4ABAH ↳19130 ↳RDHIT	T3	TRSDOS 1.3 SYS0 resident: Read Hash Index Table. On entry, Register C holds the drive number. Reads the HIT sector (track 0 sector 2) into BUFF1 at 4300H. Returns Z on success, NZ with error code on failure.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
4ABEH ↳19134	T1	TRSDOS 2.3 SYS0/SYS2: directory entry info byte (1 byte). Set by the Decode Directory Entry routine at 4B1EH during directory searches. Encodes the directory sector number and entry position within the sector.

TRSDOS 1.3 SYS0 System DCB and Saves (4457H-44ACH)

Address (Hex/Dec/Label)	Source	Description
4AC2H ↳19138 ↳WRHIT	T3	TRSDOS 1.3 SYS0 resident: Write Hash Index Table. On entry, Register C holds the drive number. Writes the HIT from BUFF1 at 4300H back to disk. Returns Z on success, NZ with error code on failure.
4B0DH ↳19213 ↳SREAD	T3	TRSDOS 1.3 SYS0 resident: Sector Read subroutine. Reads one sector for the drive in C at the track/sector parameters set by prior TRKGET/positioning calls. Used by SYS6 S6PROT to walk through directory sectors.
4B3EH ↳19262 ↳TRKGET	T3	TRSDOS 1.3 SYS0 resident: Get Directory Track for the drive in Register C. Returns the directory track number in Register D. Used by SYS6 S6PROT and S6FREE to locate the directory on the target disk.

TRSDOS 1.3 Error Handler Overlay – SYS4 (4E00H–50E6H)

Address (Hex/Dec/Label)	Source	Description
4CFDH ↳19709 ↳DOFLAG	T3	TRSDOS 1.3 SYS4: DO-file active flag (1 byte). Non-zero when a DO (chaining) file is currently executing; zero when no DO file is active. On entry to SYS4, if DOFLAG is non-zero the error handler clears it, masks bit 7 of the error code (forcing a return-to-DOS), restores the keyboard driver vector from GOSAVE, and resets MEMEND from MEM2 before falling through to the normal error-display logic.

TRSDOS 2.3 Overlay and SYS1 Work Area (44A1H–5026H)

Address (Hex/Dec/Label)	Source	Description
4D00H-4DFFH ↳19712	T1, N1	TRSDOS 2.3: overlay load buffer / secondary sector buffer (256 bytes, 4D00H–4DFFH). Used by the overlay loader at 4BA2H to stage overlay data during loading, and by various SYS routines for secondary directory sector reads.

TRSDOS 1.3 SYS0 Disk Buffers (4300H-4DFFH)

Address (Hex/Dec/Label)	Source	Description
4D00H-4DFFH ↳19712 ↳BUFF2	Model III ROM, T3	Second 256-byte disk I/O buffer (used by system/MDCB)

TRSDOS 2.3 Overlay and SYS1 Work Area (44A1H–5026H)

Address (Hex/Dec/Label)	Source	Description
4E00H ↳19968	T1	TRSDOS 2.3: overlay load address — resident overlay area base (512+ bytes). SYS1, SYS2, SYS3, SYS4, SYS5, and SYS6 all load here when invoked via RST 28H. Also the cold boot entry point: JP 4E00H from the SVC table at 4405H triggers the DOS initialization routine.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
4E4EH ↳20046	T1	TRSDOS 2.3 SYS3: saved directory entry info byte (1 byte). Written by the Kill file handler; holds the directory entry info byte during granule deallocation in the Kill File routine at 4FD0H.
4EA4H ↳20132	T1, N1	TRSDOS 2.3 SYS1: resident command table (24 bytes, 4EA4H–4EBBH). Three 8-byte entries for the built-in commands: BASIC (handler at 514CH), DEBUG (handler at 5162H), and TRACE (handler at 5191H). Searched by the command dispatcher before the overlay command table.
4EBDH-4F54H ↳20157	T1, N1	TRSDOS 2.3 SYS1: overlay command table (152 bytes, 4EBDH–4F54H). Nineteen 8-byte entries for APPEND, ATTRIB, AUTO, CLOCK, COPY, DATE, DEVICE, DIR, DUMP, FREE, KILL, LIB, LIST, LOAD, NAME, PRINT, PROT, RENAME, TIME, and VERIFY. Each entry dispatches to SYS6 via RST 28H.

TRSDOS 1.3 Close/Kill Overlay – SYS3 (4E00H–500BH)

Address (Hex/Dec/Label)	Source	Description
4EC5H ↳20165 ↳CLOCNT	T3	TRSDOS 1.3 SYS3: Self-modifying operand — extent counter for CLOSE file length check (1 byte). Operand byte of a LD A,nn instruction at 4EC4H. Initialized to MAXEXT−1 (0CH = 12 decimal) at 4EAEH, decremented each iteration at 4EC7H. Controls how many segment descriptors are checked when trimming unused granules from a file being closed.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
4F1DH ↳20253	T1, N1	TRSDOS 2.3 SYS2/SYS3: directory entry byte offset for GAT search (1 byte). Self-modifying target used by the Kill handler at 4ED8H and the open-new-file handler at 4F50H for granule allocation calculations.
4F22H ↳20258	T1, N1	TRSDOS 2.3 SYS3: self-modifying operand — track number for GAT deallocation (1 byte). Operand byte of an ADD A,00H instruction at 4F21H. Written at runtime to encode the track number into the GAT bit clear operation.

TRSDOS 1.3 Close/Kill Overlay – SYS3 (4E00H–500BH)

Address (Hex/Dec/Label)	Source	Description
4F24H-4F25H ↳20260 ↳SAVEXP	T3	TRSDOS 1.3 SYS3: Self-modifying operand — saved directory entry pointer (2 bytes). Operand bytes of a LD HL,nnnn instruction at 4F23H. Written at 4E33H after reading the directory entry for the file being closed. Used by the RESET routine to locate the filename in the directory buffer for restoring the DCB filespec.

TRSDOS 2.3 Error Handler Overlay – SYS4 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
4F36H ↳20278	T1	TRSDOS 2.3 SYS4: error code display template (fixed string). Contains LF + "*** ERRCODE=XX, " + ETX; the two XX bytes at 4F42H–4F43H are self-modified at runtime to the ASCII error code digits.
4F42H-4F43H ↳20290	T1	TRSDOS 2.3 SYS4: self-modified error code ASCII digits (2 bytes, 4F42H–4F43H). Tens digit at 4F42H, units digit at 4F43H. Written by the error display routine at 4E2AH before displaying the error template at 4F36H.
4F47H ↳20295	T1	TRSDOS 2.3 SYS4: closing error marker string. Contains "***" + CR. Displayed after the error context information.
4F4BH ↳20299	T1, N1	TRSDOS 2.3 SYS4: device display template (fixed string). Contains screen code + "<DEVICE=*XX>" + CR; bytes at 4F55H–4F56H are self-modified with the drive number and info byte from the FCB.

TRSDOS 2.3 DEBUG Monitor Overlay – SYS5 (4E00H–51FFH)

Address (Hex/Dec/Label)	Source	Description
4F54H-4F6BH ↳20308	T1, N1	TRSDOS 2.3 SYS5 DEBUG: register name display table (24 bytes, 4F54H–4F6BH). 12 entries × 2 bytes each; two ASCII characters per register pair name (AF, BC, DE, HL, IX, IY, AF', BC', DE', HL', SP, PC). Used by the Register Dump routine at 4ECFH.

TRSDOS 2.3 Error Handler Overlay – SYS4 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
4F55H-4F56H ↳20309	T1, N1	TRSDOS 2.3 SYS4: self-modified device context bytes (2 bytes, 4F55H–4F56H). Written by the Extended Error Context Display routine at 4E73H with the drive number and FCB info byte for the failing device.
4F59H ↳20313	T1	TRSDOS 2.3 SYS4: file display prefix string. Contains screen code + "<FILE=" for the error context display.

TRSDOS 1.3 Close/Kill Overlay – SYS3 (4E00H–500BH)

Address (Hex/Dec/Label)	Source	Description
4F59H ↳20313 ↳RESDRV	T3	TRSDOS 1.3 SYS3: Self-modifying operand — ASCII drive number for filespec reconstruction (1 byte). Operand byte of a LD A,nn instruction at 4F58H. Written at 4F20H with the drive number converted to ASCII (by adding 30H). Used by the RESET routine to append the drive number to the reconstructed filespec in the DCB.

TRSDOS 2.3 Error Handler Overlay – SYS4 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
4F60H ↳20320	T1, N1	TRSDOS 2.3 SYS4: filename buffer for error display (16 bytes). Filled at runtime with the NAME/EXT:D> string + CR terminator by the Filename From Directory Entry routine at 4EC4H.
4F70H ↳20336	T1, N1	TRSDOS 2.3 SYS4: return address display prefix string. Contains screen code + "REFERENCED AT X'" + ETX. Displayed before the hex return address in error context output.

TRSDOS 2.3 DEBUG Monitor Overlay – SYS5 (4E00H–51FFH)

Address (Hex/Dec/Label)	Source	Description
4F78H ↳20344	T1, N1	TRSDOS 2.3 SYS5 DEBUG: flags bit name table (8 bytes). Contains "SZ1H1PNC" (Sign, Zero, fixed-1, Half-carry, fixed-1, Parity/Overflow, Subtract, Carry). Used by Register Dump to label the F register bits.

TRSDOS 2.3 Error Handler Overlay – SYS4 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
4F82H ↳20354	T1, N1	TRSDOS 2.3 SYS4: return address display suffix string. Contains "'" + CR. Appended after the hex return address.
4F84H-4FC1H ↳20356	T1, N1	TRSDOS 2.3 SYS4: error code offset table (62 bytes, 4F84H–4FC1H). One byte per error code (00H–3DH). Each byte is a byte offset into the error message descriptor chains at 515BH, indexing the message text.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
4FA2H ↳20386	T1, N1	TRSDOS 2.3 SYS2: saved directory entry low byte / L register (1 byte). Saved during the Open New File handler at 4F50H for use during directory entry population.
4FA7H ↳20391	T1, N1	TRSDOS 2.3 SYS1: noise word keyword table (3 entries). Contains the keywords "TO", "ON", and "OVER" used by the filespec parser at 4F56H to skip noise words in command line syntax.

TRSDOS 1.3 Close/Kill Overlay – SYS3 (4E00H–500BH)

Address (Hex/Dec/Label)	Source	Description
4FACH-4FADH ↳20396 ↳SAVPNT	T3	TRSDOS 1.3 SYS3: Self-modifying operand — saved directory record pointer for KILL (2 bytes). Operand bytes of a LD HL,nnnn instruction at 4FABH. Written at 4F91H after reading the directory entry for the file being killed. Used to locate the start of the directory record for zeroing out during file deletion.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
4FAFH ↳20399	T1, N1	TRSDOS 2.3 SYS2: granule count parameter (1 byte). Holds the value of Register B on entry to the Open File handler — the number of initial granules to allocate for a new file.
4FB2H ↳20402	T1, N1	TRSDOS 2.3 SYS2: extent count (1 byte). Saved from Register B after the directory entry match. Used to populate the extent chain count field in the FCB.
4FC0H ↳20416	T1, N1	TRSDOS 2.3 SYS1: Default Extension Insertion routine. Appends the default file extension "CMD" to a filespec when no extension was supplied by the user. Called internally from the filespec parser.

TRSDOS 2.3 Error Handler Overlay – SYS4 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
4FC2H-502DH ↳20418	T1, N1	TRSDOS 2.3 SYS4: word address table (108 bytes, 4FC2H–502DH). 54 two-byte little-endian pointers, each pointing to the start of a word in the error message word string pool at 5030H.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
4FC8H ↳20424	T1	TRSDOS 2.3 SYS3: self-modifying operand — drive number with command bits (1 byte). Operand byte of an LD A,00H instruction at 4FC7H. Written at runtime to encode the drive number into the filespec construction code.
4FF4H ↳20468	T1, N1	TRSDOS 2.3 SYS1: character extraction subroutine. Reads up to B characters from (HL), storing valid filename characters to a buffer. Used by the filespec parser at 4F56H.

Memory Boundaries and Top-of-Memory Markers

Address (Hex/Dec/Label)	Source	Description
4FFFH ↳20479	Both Model I and III ROM	4K system top of physical memory.

TRSDOS 1.3 Close/Kill Overlay – SYS3 (4E00H–500BH)

Address (Hex/Dec/Label)	Source	Description
500AH ↳20490 ↳CLRBT2	T3	TRSDOS 1.3 SYS3: Self-modifying operand — RES opcode byte for GAT bit manipulation (1 byte). Target of the CLRBIT routine at 4FFFH. The routine computes a RES n,B opcode (where n is the granule's bit position within its GAT byte) and writes it here. The instruction at 5009H then executes this dynamically-constructed opcode to clear the appropriate granule bit in the GAT, freeing that granule.

TRSDOS 2.3 Overlay and SYS1 Work Area (44A1H–5026H)

Address (Hex/Dec/Label)	Source	Description
5026H ↳20518	T1, N1	TRSDOS 2.3 SYS1: filespec parser remaining-character counter (1 byte). Self-modified by the character extraction subroutine at 4FF4H. Holds the count of characters remaining to be extracted from the filespec.

TRSDOS 2.3 Error Handler Overlay – SYS4 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
5030H ↳20528	T1	TRSDOS 2.3 SYS4: error message word string pool. 53 words used to compose error messages: "NO", "ERROR", "FORMAT", "PARITY", "DURING", "HEADER", "DATA", "WRITE", "PROTECT", "LOST", "SEEK", "DRIVE", "NOT", "READY", "FILE", "SPACE", "FULL", "NAME", "OPEN", "PASS", "WORD", and others. Indexed via the offset table at 4F84H.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
5039H ↳20537	T1, N1	TRSDOS 2.3 SYS3: Free Granules In Extent Entry routine. Processes one extent entry pair (track byte + sector byte), frees the allocated granules from the GAT sector buffer at 5100H.
505BH ↳20571	T1, N1	TRSDOS 2.3 SYS3: Build GAT Bit Mask routine. Converts a granule position (0–7) into a RES opcode for self-modifying GAT bit clear operation at 5065H.
5066H ↳20582	T1	TRSDOS 2.3 SYS3: self-modifying operand — RES/SET bit opcode for GAT bit manipulation (1 byte). Target of the Build GAT Bit Mask routine at 505BH. Encodes the bit number into the RES n,B instruction.
5068H ↳20584	T1	TRSDOS 2.3 SYS3: Read GAT Sector routine. Reads the Granule Allocation Table sector (track 0, sector 1) into the 5100H buffer via SYS0 I/O routines.
5077H ↳20599	T1	TRSDOS 2.3 SYS3: Write GAT Sector routine. Writes the Granule Allocation Table sector from the 5100H buffer back to disk track 0, sector 1, via SYS0 I/O routines.

TRSDOS 1.3 DOS Command Handler Overlay – SYS6 (5200H–623DH)

Address (Hex/Dec/Label)	Source	Description
5081H ↳20609 ↳CHKFLG	T3	TRSDOS 1.3 SYS1 entry point: Parse ON/OFF keyword from command line. Called by SYS6 CLOCK handler to determine whether the user requested CLOCK ON or CLOCK OFF. Returns Z for OFF, NZ for ON.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
5086H ↳20614	T1, N1	TRSDOS 2.3 SYS3: unused overlay padding (FFH fill, 5086H–50FFH). Marks the end of the SYS3 overlay code; bytes beyond this point are not executed.
509BH ↳20635	T1, N1	TRSDOS 2.3 SYS2: Compute Filename CRC Hash routine. Computes an 8-bit XOR/rotate hash of the 11-byte filename (8+3) for quick directory comparison before full name matching.
50ABH ↳20651	T1, N1	TRSDOS 2.3 SYS2: Scan Directory Entry for Free Slot routine. Scans the directory sector at 4D00H for an unused (zero first-byte) entry slot for new file creation.
50BDH ↳20669	T1	TRSDOS 2.3 SYS2: Check Directory Entry Active routine. Tests if the directory entry at (HL) is active (non-zero first byte). Returns with Z flag set if the entry is unused.

TRSDOS 1.3 DOS Command Handler Overlay – SYS6 (5200H–623DH)

Address (Hex/Dec/Label)	Source	Description
50C9H ↳20681 ↳LIBCOM	T3	TRSDOS 1.3 SYS1 data: Table of built-in command names (6 characters per name, null-terminated list). Used by SYS6 LIB command to display the library command names 8 per line.
50CDH ↳20685 ↳GETFLD	T3	TRSDOS 1.3 SYS2 entry point: Parse a field of alphanumeric characters from the command-line pointer at HL into the buffer at DE. Used by SYS6 ATTRIB for password parsing.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
50D1H ↳20689	T1	TRSDOS 2.3 SYS2: Compute 16-Bit Filename Hash routine. Computes a CRC-style 16-bit hash of the password buffer for password integrity verification during file open.

TRSDOS 2.3 DEBUG Monitor Overlay – SYS5 (4E00H–51FFH)

Address (Hex/Dec/Label)	Source	Description
50E0H ↳20704	T1	TRSDOS 2.3 SYS5 DEBUG: Z80 opcode classification table. Triplets of (mask, match, type) bytes for unprefixed, ED-prefixed, and DD/FD-prefixed instructions. Used by the I/C (Instruction decode) command at 505DH to identify instruction lengths and operand types.

TRSDOS 1.3 DOS Command Handler Overlay – SYS6 (5200H–623DH)

Address (Hex/Dec/Label)	Source	Description
50E7H ↳20711 ↳HASH	T3	TRSDOS 1.3 SYS2 entry point: Compute 16-bit filename hash from the 11-byte name at HL. Returns hash in A. Used by SYS6 RENAME to recompute the hash code when a file is renamed.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
50FDH ↳20733	T1	TRSDOS 2.3 SYS2: Select Drive and Detect Write Protect routine. Issues a Force Interrupt command to the WD1771 FDC, selects the drive via SYS0, polls FDC status for write-protect detection.
5100H-51FFH ↳20736	T1, N1	TRSDOS 2.3 SYS3: GAT sector buffer (256 bytes, 5100H–51FFH). Holds the Granule Allocation Table for the current drive during granule allocation and deallocation operations.

TRSDOS 1.3 DOS Command Handler Overlay – SYS6 (5200H–623DH)

Address (Hex/Dec/Label)	Source	Description
5107H ↳20743 ↳SETTDC	T3	TRSDOS 1.3 SYS2 entry point: Compute trap-door-code (password hash) from the 8-byte password at DE. Returns 16-bit hash in HL. Used by SYS6 ATTRIB for access/update password hashing and by S6PROT for master password hashing.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
511EH ↳20766	T1	TRSDOS 2.3 SYS2: Poll FDC Status Bit 1 routine. Reads the WD1771 FDC status register and tests bit 1 (Index/DRQ), with a timeout loop counted by BC.
512EH ↳20782	T1, N1	TRSDOS 2.3 SYS2: Read Directory Sector routine. Reads the directory sector for the current drive (drive number from Register C) into the 4D00H buffer via SYS0 I/O routines.

TRSDOS 1.3 Open/Init Overlay – SYS2 (4E00H–5150H)

Address (Hex/Dec/Label)	Source	Description
5137H ↳20791 ↳SID	T3	TRSDOS 1.3 SYS2: Requested side number variable (SID). Set by CRACK during filespec parsing. FFH = use global/default side; 0–1 = specific side.
5138H ↳20792 ↳DRV	T3	TRSDOS 1.3 SYS2: Requested drive number variable (DRV). Set by CRACK during filespec parsing. FFH = search all drives; 0–3 = specific drive. Also updated by OPEN when the file is found to record the actual drive.
5139H-5140H ↳20793 ↳PWORD	T3	TRSDOS 1.3 SYS2: Password field buffer (PWORD, 8 bytes). Set by CRACK when parsing a filespec containing a password (after '.' separator). Space-padded.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
5141H ↳20801	T1	TRSDOS 2.3 SYS2: Write Directory Sector routine. Writes the directory sector from the 4D00H buffer back to disk via SYS0 I/O routines.

TRSDOS 1.3 Open/Init Overlay – SYS2 (4E00H–5150H)

Address (Hex/Dec/Label)	Source	Description
5141H-5148H ↳20801 ↳NAME	T3	TRSDOS 1.3 SYS2: Filename buffer (NAME, 8 bytes). Set by CRACK during filespec parsing. Space-padded. This is the first of four order-dependent contiguous fields (NAME, EXT, UPDTDC, ACCTDC) copied together by the LDIR at 4FEBH.
5149H-514BH ↳20809 ↳EXT	T3	TRSDOS 1.3 SYS2: File extension buffer (EXT, 3 bytes). Set by CRACK when parsing a filespec containing an extension (after '/' separator). Space-padded.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
514CH ↳20812	T1	TRSDOS 2.3 SYS1: BASIC command handler (entry in resident command table). Starts non-DOS Level II BASIC by copying ROM vectors (36H bytes from 06D2H) back to 4000H, then jumping to the Level II BASIC cold start.

TRSDOS 1.3 Open/Init Overlay – SYS2 (4E00H–5150H)

Address (Hex/Dec/Label)	Source	Description
514CH-514DH ↳20812 ↳UPDTDC	T3	TRSDOS 1.3 SYS2: Update password Trap Door Code (UPDTDC, 2 bytes). Computed by SETTDC from the password and stored here by S2OPEN. Compared against the directory entry's update TDC during protection checking. A match grants full (update) access to the file.
514EH-514FH ↳20814 ↳ACCTDC	T3	TRSDOS 1.3 SYS2: Access password Trap Door Code (ACCTDC, 2 bytes). Initially set equal to UPDTDC by S2OPEN. Compared against the directory entry's access TDC during protection checking. A match grants limited (read) access to the file.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
5154H ↳20820	T1	TRSDOS 2.3 SYS2: drive number for current directory operation (1 byte). FFH = search all drives. Set before calling directory search routines.
5155H-515CH ↳20821	T1, N1	TRSDOS 2.3 SYS2/SYS6: password buffer (8 bytes, 5155H–515CH). Space-padded 8-character password field. Used by the filespec parser, directory search, and the PROT command in SYS6.

TRSDOS 2.3 Error Handler Overlay – SYS4 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
515BH ↳20827	T1	TRSDOS 2.3 SYS4: error message descriptor chains. Variable-length byte sequences; bits 0–5 of each byte = word index into the string pool at 5030H; bit 6 = continuation flag (more words follow); bit 7 = end of message. One chain per error code, indexed via 4F84H.

TRSDOS 2.3 Close/Kill Overlay – SYS3 (4E00H–50FFH)

Address (Hex/Dec/Label)	Source	Description
515DH-5167H ↳20829	T1, N1	TRSDOS 2.3 SYS2: filename/extension template buffer (11 bytes, 515DH–5167H). Space-padded 8-char name + 3-char extension. Populated by the filespec parser and used for directory entry matching.
5162H ↳20834	T1, N1	TRSDOS 2.3 SYS1: DEBUG command handler. Toggles the DEBUG flag (bit 7 at 430FH), patches the BREAK handler to trap RST F7H breakpoints, and installs the DEBUG display hooks at 4030H and 4031H.
5168H-5169H ↳20840	T1, N1	TRSDOS 2.3 SYS2: filename hash value (2 bytes, 5168H–5169H). 16-bit CRC-style hash of the password buffer computed by 50D1H. Compared against the stored hash in the directory entry for password verification.
516AH-516BH ↳20842	T1	TRSDOS 2.3 SYS2: copy of filename hash (2 bytes, 516AH–516BH). Duplicate of the 5168H hash value, retained for comparison after the directory sector is reloaded.
5191H ↳20881	T1	TRSDOS 2.3 SYS1: TRACE command handler. Toggles TRACE mode by enqueueing or dequeueing the TRACE timer interrupt callback (target 4CD9H) in the SYS0 timer interrupt chain.
51AFH ↳20911	T1, N1	TRSDOS 2.3 SYS1: option keyword matching buffer (variable length). Destination for parsed keyword values from the option parser at 507DH (SYS1 request code 60H).
51B5H ↳20917	T1, N1	TRSDOS 2.3 SYS1: default extension string (3 bytes). Contains "CMD" (43H 4DH 44H). Used when loading unrecognized commands as program files.
51B8H ↳20920	T1, N1	TRSDOS 2.3 SYS1: DOS READY prompt string (12 bytes). 0AH + "DOS READY" + 0DH. Displayed by the command prompt routine at 4E1FH.
51C3H ↳20931	T1	TRSDOS 2.3 SYS1: error message string for unrecognized commands. "WHAT?" + 0DH. Displayed when the command line parser fails to match any resident or overlay command.

TRSDOS 2.3 Disk BASIC (BASIC/CMD) Variables and Jump Table (5200H–6575H)

Address (Hex/Dec/Label)	Source	Description
5200H ↳20992	T1, N1, T3	TRSDOS 2.3 Disk BASIC (BASIC/CMD) entry point. Command dispatcher for 19 Disk BASIC commands. Loaded by TRSDOS when the user types BASIC at the DOS READY prompt.
5203H ↳20995	T1	TRSDOS 2.3 Disk BASIC: error message table (ERRTAB). Disk BASIC–specific error message strings for I/O errors. Referenced by the error display routine at 57E6H.
5517H ↳21783	T1	TRSDOS 2.3 Disk BASIC: BASIC error handler entry point. Processes Disk BASIC runtime errors; called when an error occurs during file I/O operations.
551AH ↳21786	T1	TRSDOS 2.3 Disk BASIC: USR(n) dispatch vector (3 bytes). JP nnnn to the routine that determines which USR function number was called and fetches the appropriate jump address.
551DH ↳21789	T1	TRSDOS 2.3 Disk BASIC: PTRFIL zero and file close vector (3 bytes). JP nnnn to the routine that zeroes PTRFIL and closes the currently open disk file.
5520H ↳21792	T1	TRSDOS 2.3 Disk BASIC: disk INPUT check vector (3 bytes). JP nnnn to the routine that determines whether an INPUT request should come from a disk file.
5523H ↳21795	T1	TRSDOS 2.3 Disk BASIC: direct statement dispatch vector (3 bytes). JP nnnn to the routine that dispatches direct statement execution under Disk BASIC.
5526H ↳21798	T1	TRSDOS 2.3 Disk BASIC: line insertion preparation vector (3 bytes). JP nnnn to the routine that prepares for inserting a new program line.
552CH ↳21804	T1	TRSDOS 2.3 Disk BASIC: close all files vector (3 bytes). JP nnnn to the routine that closes all open disk files (CLSALL at 61A5H).
552FH ↳21807	T1	TRSDOS 2.3 Disk BASIC: zero PTRFIL and return vector (3 bytes). JP nnnn — zeroes PTRFIL and RETurns to the ROM BASIC caller.
5532H ↳21810	T1	TRSDOS 2.3 Disk BASIC: character output to disk file vector (3 bytes). JP nnnn to the output character routine at 5A21H.
5535H ↳21813	T1, N1	TRSDOS 2.3 Disk BASIC: LINE INPUT from disk vector (3 bytes). JP nnnn to the LINE INPUT disk handler at 5A30H.
5538H ↳21816 ↳LRUN	T1, N1	TRSDOS 2.3 Disk BASIC: LRUN command vector (3 bytes). JP nnnn — Load and RUN a program from disk. Entry point for the LRUN command.
553BH ↳21819	T1	TRSDOS 2.3 Disk BASIC: cassette vs. disk I/O check vector (3 bytes). JP nnnn to the routine that determines whether the current command targets cassette or disk I/O.
553EH ↳21822	T1	TRSDOS 2.3 Disk BASIC: CRLF destination check vector (3 bytes). JP nnnn to the routine that determines whether CRLF output goes to disk or printer.
5544H ↳21828	T1	TRSDOS 2.3 Disk BASIC: disk I/O processing vector (3 bytes). JP nnnn to the main disk I/O dispatch routine.
5547H ↳21831	T1	TRSDOS 2.3 Disk BASIC: INPUT#n check vector (3 bytes). JP nnnn to the routine that checks whether an INPUT statement is actually INPUT#n (file input).
554DH ↳21837	T1	TRSDOS 2.3 Disk BASIC: sequential read setup vector (3 bytes). JP nnnn to the routine that sets up state for reading a sequential item from a disk file.

TRSDOS 2.3 Library Commands Overlay – SYS6 (5200H–6FFFH)

Address (Hex/Dec/Label)	Source	Description
5551H-5570H ↳21841	T1	TRSDOS 2.3 SYS6: primary parsed filespec buffer (32 bytes, 5551H–5570H). Holds the first NAME/EXT.PASSWORD:DRIVE filespec after parsing by SYS1. Used by all two-filespec library commands.

TRSDOS 2.3 Disk BASIC (BASIC/CMD) Variables and Jump Table (5200H–6575H)

Address (Hex/Dec/Label)	Source	Description
5556H ↳21846 ↳PUSVAL	T1, N1	TRSDOS 2.3 Disk BASIC: DEF FN handler (PUSVAL). Processes user-defined function calls. Entry point for the DEF FN evaluation mechanism.

TRSDOS 2.3 Library Commands Overlay – SYS6 (5200H–6FFFH)

Address (Hex/Dec/Label)	Source	Description
5571H-5590H ↳21873	T1	TRSDOS 2.3 SYS6: secondary parsed filespec buffer (32 bytes, 5571H–5590H). Holds the second filespec for two-operand commands (COPY, APPEND, RENAME). Populated by the second pass of the filespec parser.

TRSDOS 1.3 SYS13 BASIC Variable Storage (5587H–558AH)

Address (Hex/Dec/Label)	Source	Description
5587H ↳21895 ↳YR	T3	TRSDOS 1.3 SYS13: BASIC year storage. Used by the CMD"J" Julian-date conversion (SYS13 RETJUL/RETDAT routines) to hold the 2-digit year (00-99) read from the user's calendar-date string. Written via LD (YR),A at 4F1D and 4F9B; read via LD A,(YR) at 4FBC and 500D. Persistent in BASIC's workspace because BASIC stays resident; SYS13 is the transient overlay that uses it. Defined as YR EQU 5587H in BASIC.GBL.
5588H ↳21896 ↳MT	T3	TRSDOS 1.3 SYS13: BASIC month storage. Used by the CMD"J" Julian-date conversion (SYS13 RETJUL/RETDAT routines) to hold the month value (1-12). Written via LD (MT),A at 4F07, 4FCE, 500A, and 5028; read via LD A,(MT) at 4F2B, 4F37, 5014, 5024, 5037, 5048, and 5359. Persistent in BASIC's workspace because BASIC stays resident; SYS13 is the transient overlay that uses it. Defined as MT EQU 5588H in BASIC.GBL.
5589H ↳21897 ↳DY	T3	TRSDOS 1.3 SYS13: BASIC day storage. Used by the CMD"J" Julian-date conversion (SYS13 RETJUL/RETDAT routines) to hold the day-of-month value (1-31). Written via LD (DY),A at 4F12, 4FD3, 5003, 501F, 5033, and 5040; read via LD A,(DY) at 4F45 and 5058. Persistent in BASIC's workspace because BASIC stays resident; SYS13 is the transient overlay that uses it. Defined as DY EQU 5589H in BASIC.GBL.
558AH-5591H ↳21898 ↳RTEMP	T3	TRSDOS 1.3 SYS13: BASIC temporary ASCII-date storage (8 bytes, 558AH-5591H). Used by SYS13's date-conversion routines as the staging area for the formatted ASCII output. For Julian (CMD"J" forward), 3 bytes of ASCII Julian day are placed here at 4F54 and copied from here to the user's string variable at 4F85 via LDIR. For Gregorian (CMD"J" reverse), MOVIT places MM/DD/YY (8 bytes including slashes) here at 5051/5061/506F via the MOVIT subroutine, and an LDIR at 509A copies the 8 bytes to the user's string variable. Persistent in BASIC's workspace because BASIC stays resident; SYS13 is the transient overlay that uses it. Defined as RTEMP EQU 558AH in BASIC.GBL.

TRSDOS 2.3 Library Commands Overlay – SYS6 (5200H–6FFFH)

Address (Hex/Dec/Label)	Source	Description
5600H-56FFH ↳22016	T1	TRSDOS 2.3 SYS6: primary FCB work area (256 bytes, 5600H–56FFH). File Control Block for the primary file used by library commands (COPY, LIST, PRINT, DIR, etc.).

TRSDOS 2.3 Disk BASIC (BASIC/CMD) Variables and Jump Table (5200H–6575H)

Address (Hex/Dec/Label)	Source	Description
5A77H-5B76H ↳23159 ↳DIRTMP	T1	TRSDOS 2.3 Disk BASIC: variable storage area base (DIRTMP). 00H flag byte followed by 255 bytes of workspace (5A78H–5B76H). Used as a temporary directory/work buffer by Disk BASIC I/O routines.
5B77H-5B8AH ↳23415 ↳USRTAB	T1	TRSDOS 2.3 Disk BASIC: DEF USR jump vector table (USRTAB, 20 bytes, 5B77H–5B8AH). Ten 2-byte vectors (USR 0–9), each initialized to 4A 1EH (JP 1E4AH, BASIC error "FC ERROR"). Overwritten by DEF USR n=addr.
5B8BH ↳23435 ↳MAXTRK	T1	TRSDOS 2.3 Disk BASIC: GET/PUT direction flag (MAXTRK, 1 byte). 00H = GET (read); non-zero = PUT (write). Set by the GET/PUT command handlers at 6354H.
5B8CH ↳23436 ↳DSKERR	T1	TRSDOS 2.3 Disk BASIC: disk error code (DSKERR, 1 byte). Holds the most recent TRSDOS error code returned by a disk SVC call. Tested by error handling routines throughout Disk BASIC.
5B8DH-5B8EH ↳23437 ↳PTRFIL	T1	TRSDOS 2.3 Disk BASIC: file pointer / I/O mode flag (PTRFIL, 2 bytes, 5B8DH–5B8EH). Multi-purpose: tracks address of the file DCB in use; also signals whether the current command requires disk I/O vs. keyboard I/O. 0000H = no disk file active.
5B8FH ↳23439 ↳FILPTR	T1	TRSDOS 2.3 Disk BASIC: file block pointer table (FILPTR, up to 30 bytes). Table of 2-byte DCB (Device Control Block) pointers, one per open file (files 1 through max FILES). Each pair points to the FCB/DCB for that file number. Indexed by the file number from OPEN/GET/PUT/CLOSE etc.
5C06H ↳23558 ↳INIT	T1	TRSDOS 2.3 Disk BASIC: program start / ORG entry point (INIT). Cold-start initialization: validates DOS version compatibility, sets up the Disk BASIC vector table, asks FILES? and MEMORY SIZE? questions, then transfers to the Level II BASIC main loop.
5C98H ↳23704 ↳PTCMD	T1	TRSDOS 2.3 Disk BASIC: re-entry flag (PTCMD, 1 byte). Non-zero (typically '*') = BASIC is being restarted with preserved parameters; 00H = fresh start. Set by CMD"R" (restart BASIC).
5C99H-5C9AH ↳23705 ↳SVTXTT	T1	TRSDOS 2.3 Disk BASIC: saved BASIC program start address (SVTXTT, 2 bytes). Saved on BASIC entry from the ROM's TXTTAB variable; restored on CMD"R" re-entry to resume at the same program location.
5C9BH-5C9CH ↳23707 ↳FILSVS	T1	TRSDOS 2.3 Disk BASIC: saved FILES count (FILSVS, 2 bytes). Stores the answer to the `HOW MANY FILES?` question for CMD"R" re-entry. Initialized from 408EH (MAXFIL) on first entry.
5C9DH-5C9EH ↳23709 ↳OLSTTP	T1	TRSDOS 2.3 Disk BASIC: saved string storage top (OLSTTP, 2 bytes). Stores the lowest address available for string storage (top of free memory) on BASIC entry; restored on CMD"R" re-entry.

TRSDOS 1.3 DOS Command Handler Overlay – SYS6 (5200H–623DH)

Address (Hex/Dec/Label)	Source	Description
5CEFH ↳23791 ↳MASTPW	T3	TRSDOS 1.3 SYS0 constant: Default master-password hash value (2 bytes). Represents the "no password set" state in directory hash fields. The DIR command compares directory hash bytes against this constant to distinguish files with no password from files with passwords set.

TRSDOS 2.3 Disk BASIC (BASIC/CMD) Variables and Jump Table (5200H–6575H)

Address (Hex/Dec/Label)	Source	Description
5D53H-5E56H ↳23891 ↳BUF-3	T1, N1	TRSDOS 2.3 Disk BASIC: I/O buffer area (BUF-3, 260 bytes, 5D53H–5E56H). General-purpose disk I/O buffer used by sequential file read/write routines.
5EA3H-5EC2H ↳24227 ↳FILNAM	T1	TRSDOS 2.3 Disk BASIC: filename work buffer (FILNAM, 32 bytes, 5EA3H–5EC2H). Filename is stored here during OPEN/KILL/NAME operations. Filled by the NAMFIL routine at 63EDH.

TRSDOS 2.3 Library Commands Overlay – SYS6 (5200H–6FFFH)

Address (Hex/Dec/Label)	Source	Description
6100H-68FFH ↳24832	T1	TRSDOS 2.3 SYS6: directory image buffer (2048 bytes, 6100H–68FFH). Used by the DIR command to hold up to 8 full directory sectors (256 bytes each) during directory listing operations.

TRSDOS 2.3 Disk BASIC (BASIC/CMD) Variables and Jump Table (5200H–6575H)

Address (Hex/Dec/Label)	Source	Description
651EH ↳25886 ↳FLRL	T1	TRSDOS 2.3 Disk BASIC: logical record length storage (FLRL, 1 byte). Holds the LRL (logical record length) for the current file operation. Set during OPEN and used by GET/PUT to size record transfers.
651FH ↳25887 ↳DOPROT	T1	TRSDOS 2.3 Disk BASIC: protected file execution flag (DOPROT, 1 byte). FFH = permit running a protected file; 00H = do not run. Checked before loading files with protection bits set.
6520H ↳25888 ↳PROTFL	T1	TRSDOS 2.3 Disk BASIC: protection clear-memory flag (PROTFL, 1 byte). Non-zero = protection has cleared memory (first 1100 bytes of program RAM have been zeroed at 64FEH). Zero = no clearing needed.

TRSDOS 2.3 Library Commands Overlay – SYS6 (5200H–6FFFH)

Address (Hex/Dec/Label)	Source	Description
6F00H-6FFFH ↳28416	T1	TRSDOS 2.3 SYS6: secondary FCB work area (256 bytes, 6F00H–6FFFH). File Control Block for the secondary file used by the APPEND command.

Memory Boundaries and Top-of-Memory Markers

Address (Hex/Dec/Label)	Source	Description
7FFFH ↳32767	Both Model I and III ROM	16K system top of physical memory.
BFFFH ↳49151	Both Model I and III ROM	32K system top of physical memory.
FFFFH ↳65535	Both Model I and III ROM	48K system top of physical memory.

TRSDOS 1.3 Disk BASIC (BASIC/CMD) Variables and Workspace (5200H–6520H)

Address (Hex/Dec/Label)	Source	Description
5200H ↳20992 ↳DOPROT	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: protected file execution flag (DOPROT, 1 byte). FFH if currently running a protected (encrypted) BASIC program, 00H otherwise. Restored from PROSAV on '*' restart by INIT.
5201H ↳20993 ↳PROTFL	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: protection clear-memory flag (PROTFL, 1 byte). Non-zero when a protected program load is in progress; signals BASIC to clear variable space and not display LIST.
5202H ↳20994	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: third file-state flag byte (1 byte). Reserved/auxiliary state byte adjacent to DOPROT/PROTFL.
63B6H ↳25526 ↳FLRL	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Logical record length for current file operation (FLRL). Set by FIELD/GET/PUT processing; persists across BASIC commands.
63B7H ↳25527 ↳PTRFLG	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: BASIC pointer flag - set by NEW/RUN to mark when program-line back-pointers have been chained (PTRFLG). Read by RUN/CONT/GOTO.
63B8H-63B9H ↳25528 ↳LINE1	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: First line number cache (DEFW 0) (LINE1, 2 bytes). Used during program execution context tracking.
63BAH-63BBH ↳25530 ↳CONTXT	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Context pointer for FOR/NEXT/GOSUB and disk I/O resumption (DEFW 0) (CONTXT, 2 bytes).
63BCH ↳25532 ↳DSKERR	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Last DOS error number from the operating system (DSKERR). Set by all disk-I/O routines on failure; read by BASIC error handler.
63BDH ↳25533 ↳MAXTRK	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: GET/PUT direction flag (DEFS 1) (MAXTRK). 00H = GET (read), non-zero = PUT (write). Used by random-access file I/O.
63BEH-63BFH ↳25534 ↳PTRFIL	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Address of file being used (DEFS 2; FCB pointer) (PTRFIL, 2 bytes). 0000H = no active file. Set by file-open / pre-I/O setup.
63C0H-63DFH ↳25536 ↳FILPTR	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: File block pointer table (DEFS 32) (FILPTR, 32 bytes). 16 entries x 2 bytes each, holding the FCB address for each open file (0. . 15).
63E0H-63E1H ↳25568 ↳FILPT1	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Copy of FILPTR pointer at file 0 (DEFS 2) (FILPT1, 2 bytes). Saved by FLSET1 for re-entry.
63E2H-63E3H ↳25570 ↳LSTFRE	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Flag whether to run program after init (DEFS 2) (LSTFRE, 2 bytes). Holds saved free-memory pointer.
63E4H ↳25572 ↳PTCMD	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Re-entry / restart marker (DEFS 1) (PTCMD). Holds first character of the BASIC command line; '*' indicates a soft restart with saved file/memory parameters.
63E5H-63E6H ↳25573 ↳SVTXTT	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Saved BASIC program start address (DEFS 2) (SVTXTT, 2 bytes). Stores TXTTAB at INIT entry; restored on '*' restart.
63E7H-63E8H ↳25575 ↳FILSVS	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Saved FILES count (DEFS 2) (FILSVS, 2 bytes). Stores MAXFIL value at INIT entry; restored on '*' restart.
63E9H-63EAH ↳25577 ↳OLSTTP	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Saved STKTOP / string-storage top (DEFS 2) (OLSTTP, 2 bytes). Captured at INIT entry; restored on '*' restart.
63EBH ↳25579 ↳BUFEND	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Buffer end marker (DEFS 1) (BUFEND). Initialized to 0 by INIT; used by command-line input buffer code.
63ECH ↳25580 ↳FILFLG	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Files-specified flag (DEFS 1) (FILFLG). Non-zero if user supplied -F:x on command line.
63EDH ↳25581 ↳MEMFLG	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Memory-specified flag (DEFS 1) (MEMFLG). Non-zero if user supplied -M:x on command line.
63EEH-63EFH ↳25582 ↳CPMLIN	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Saved command-line pointer at INIT entry (DEFS 2) (CPMLIN, 2 bytes). Set by first instruction of INIT; used by command-line parser.
63F0H-6408H ↳25584 ↳CPMNAM	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: Filename buffer for command-line program name (DEFS 25) (CPMNAM, 25 bytes). Built by parser from -F-style command line; used by LRUN.
6150H-624FH ↳24912 ↳BUF	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: general I/O work buffer (BUF, 256 bytes, 6150H-624FH). Defined as BUF EQU $+3 at the start of BASBUF/SRC; physically reuses the INIT routine's code area, which is overwritten once initialization completes.
6250H-634FH ↳25168 ↳DIRTMP	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: directory temporary buffer (DIRTMP, 256 bytes, 6250H-634FH). Defined as DIRTMP EQU BUF+256; overlays INIT code area. Used by directory-related operations (FILES list, NAME).
6350H-6367H ↳25424 ↳FILNAM	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: filename work buffer (FILNAM, 24 bytes, 6350H-6367H). Defined as FILNAM EQU DIRTMP+256; holds the current filename being processed by OPEN/KILL/NAME/LOAD/SAVE.
64DCH ↳25820 ↳ENDBAS	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: file buffer area base (ENDBAS). First byte beyond the BASIC overlay's static workspace. INIT allocates one 360-byte (168H) FCB+buffer slot here per open file; FILPTR entries point into this region. TXTTAB (BASIC program start) is set to (last file buffer end) + 1.
5E69H ↳24169 ↳LRL2	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: LRL2 self-modifying storage (1 byte). Operand byte of LD A,0 at 5E68H, also re-read as LD A,(5E69H) at 5E71H. Holds the logical record length (LRL) for the LOC function. Defined in source as LRL2 EQU $+1; persists across BASIC commands while BASIC is running.
5E70H ↳24176 ↳EOF2	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: EOF2 self-modifying storage (1 byte). Operand byte of LD L,0 at 5E6FH. Holds the EOF/offset byte used in the LOC record-number computation. Defined in source as EOF2 EQU $+1; persists while BASIC is running.
5F01H ↳24321 ↳GETX	Model III ROM, T3	TRSDOS 1.3 Disk BASIC: GETX position flag (1 byte). Operand byte of LD A,0 at 5F00H, written via LD (GETX),A earlier in the GET/PUT setup. 00H = read next sequential record; FFH = position to specific record number. Defined in source as GETX EQU $+1; persists across each GET/PUT statement.