While we're talking about the RiscPC driver, I'd like some eyes on whether or not the default BIOS (3.71) is actually a good dump.
As it is currently, the first instruction it executes does a R15-relative load of R15, fetching the value 0x224 from address 0x118 in ROM, and thereby branching to that address.
In the current dump of 3.71 that MAME has, that location is just a table containing 0xF0000000 masked with rightward-walking bits, followed by the corresponding inversions, as depicted (partially) here:
The first valid code appears to be at 0x30C, which it eventually runs to by what looks like blind chance.
RiscOS 4.02 (-bios 1) meanwhile does the same fetch from address 0x118, but in that case the value it fetches is 0x117EC, which contains definitively valid code.
I only ran across this while trying to diagnose why a7000p regressed as a result of my MMU/TLB-related changes back in October of last year, but at this point I'm more or less convinced that the a7000p driver with the default BIOS (RiscOS 3.71) only showed its boot text by pure chance, and not out of any prior validity before my changes.