I was able to dump the Milton MC6805P2 electronically using non-user mode. But oddly enough, I wasn't able to get it
to go into self-test, even though that's well documented.
I put the chip on a breadboard and gave it power, put a 1MHz clock on EXTAL, grounded XTAL, tied /RESET, /INT and TIMER high
and connected NUM to +5. I checked each port with an LA and noted that all PORT A bits were high, PORT B bits were toggling
(apparently) randomly, PORT C<3> was high and C<2:0> were toggling.
So I assumed PORT A and C<3> were inputs and the others were outputs. I figured opcodes would be fed into PORT A, so
I used 8 1K resistors to +5 and ground to set it to $9D, the opcode for NOP. I also tied C<3> high for the first test. I
captured PORT B and C<2:0> and was surprised to see an obviously repeated pattern every 16384 uS. Looking closer, there were
8 clocks between bytes being output, and 16384/8 = 2048, which corresponds to the 11-bit address space. Port C<2:0> outputs
bits 8-6 of the address bus, so it counts from 000 to 111 four times during a complete dump.
After searching for a while, I found the bytes that I had visually transcribed from the Milton die shot. I verified that all
the electronic dumps I made were identical, then compared the electronic dumps to the visual dump, and found 4 more bit errors
in my visual dump.
I was confused about where the dump was starting; each time it re-started at the same byte after reset, 1437 bytes in.
Then I realized that it was fetching the reset vector from $7FE, but was getting $9D9D from the resistors, which translated
to $59D in the 11-bit address space. So it dumped from there to the end before wrapping around to $000.
I was expecting to have to feed the chip opcodes to dump the ROM contents, so I was surprised but happy that it turned out
there was a simpler way. It looks like in non-user mode that the chip fetches the byte from memory and puts in on PORT B,
then executes the opcode on PORT A. Since I had made it a NOP, it just kept fetching the next byte. I'm not sure if any
of the other 6805 varieties will do the same, but maybe this will help.