I'll do a capture while dumping one of those 28DIP VSMs; they use 1-bit mode.
I can do an incomplete address test, but since I'm just tying DATA/ADDR to GND to force in the 0000 address, I'll have to do it a bit differently. I can start off like my normal dumps, read some nibbles, then load in 1-3 0s and see where the next read comes from.