I rewrote MAME TMS6100 command handling:
http://git.redump.net/mame/tree/src/devices/machine/tms6100.h
http://git.redump.net/mame/tree/src/devices/machine/tms6100.cpp

mrchalgr works bug-free now. One thing that still needs to be emulated is VSM chip-chaining. Take for example the dual-VSM Speak & Spell, with a cartridge inserted. Currently this is emulated in the same single device. In reality each chip gets auto-enabled/disabled when the address range is (in)valid, so for example:

address 0000-3fff auto selects chip 1
address 4000-7fff auto selects chip 2, etc..
Each chip has a 4-bit chip-select (mask-programmable) that is compared with the high 4 bits of the full address.

Anyway, in short, it works fine as it is now. Adding this is a lot of work, not worth it to me.

Also, I had a quick look at the TMS0952 die image. Before this, I assumed it's similar to TMS0970, but it actually looks like it's a TMS1000 with a smaller output PLA.