mrchalgr works bug-free now. One thing that still needs to be emulated is VSM chip-chaining. Take for example the dual-VSM Speak & Spell, with a cartridge inserted. Currently this is emulated in the same single device. In reality each chip gets auto-enabled/disabled when the address range is (in)valid, so for example:
address 0000-3fff auto selects chip 1 address 4000-7fff auto selects chip 2, etc.. Each chip has a 4-bit chip-select (mask-programmable) that is compared with the high 4 bits of the full address.
Anyway, in short, it works fine as it is now. Adding this is a lot of work, not worth it to me.
Also, I had a quick look at the TMS0952 die image. Before this, I assumed it's similar to TMS0970, but it actually looks like it's a TMS1000 with a smaller output PLA.