It looks to me like snes_console_state::gun_latch_cb is the issue:
// m_ppu->set_latch_hv(x, y); // it would be more accurate to write twice to WRIO register, first with bit7 = 0 and then with bit7 = 1
m_ppu->set_latch_hv(m_ppu->current_x(), m_ppu->current_y());
The intent is to latch the current H/V position of the beam, which is what happens with the real hardware, since the latching occurs when the Super Scope detects the beam and pulls an I/O pin low on the controller port.
However, in MAME's case, this callback seems to be called whenever the game polls the joypad button states, which can happen at any time (including automatically during vblank). The result is that the actual cursor position gets ignored in favor of whatever the beam position happened to be when the button polling occurred.
