So this is a clear challenge to someone investigating the details of these chips. I don't expect any dramatic secrets to be hidden, and it is actually kind of nice that the bootrom "hides itself" once its job is done, rather than cluttering up the address space. Whatever the case, it must be exposed to the processor at some point and it is our job to figure out how to dump it and examine it.
Tom's Computer Info / tom@mmto.org