I scanned 35 TMS1100 and TMS1000 dumps currently working in MAME, looking for BR/CALLs that this method would miss. The average number of bytes per dump that have the same lower 6 bits as the next PC address is 32: the range is from 3 to 61. The average number of these that are really BR/CALLs is 7, ranging from 0 to 23.
This is higher than I was hoping, since these would have to be determined by running the ROM and looking for issues, or doing code analysis to determine if the opcode is really a BR/CALL.
I thought about using a similar method, shifting in an address, executing the opcode there, then shifting out the ROM byte at the next address. This could identify jumps to different pages, since the ROM byte at an address in one page is usually different from the ROM bytes at the same address in the other 31 pages. It would not identify a jump to the same page, which I guess is used as a NOP. But doing the analysis, I was surprised how many times the ROM byte was found at the same address of a different page: an average of 32 jumps are to addresses with the same lower 6 bits as the next PC address, and an average of 14 of those have the same next ROM byte in at least one other page. And since shifting the opcode out destroys the chapter and page, we can't shift out multiple bytes to uniquely identify the chapter and page.
