I got the Mattel Children's Discovery System. So far it looks true to the schematics in patent 4492582, but I haven't pried off all the die protectors yet. The carts are unfortunately glued shut, and only 15 of the COP444's 28 pins are routed to the connector. I opened the 6 carts that I got, and the PCBs are identical except for labeling. It looks like they used a 1-letter code for each cart, and they also printed the 3-letter ROM code onto each PCB.

They did bond the remaining pins to test pads, which is very helpful, and the cover over the die doesn't have to be removed to get to them. The test pads aren't labeled, so I pulled one cover off so I could follow the traces.

The L port isn't used by the carts, so I figure my simplified dumping method won't work. It relies on the chip's code to set the L port to output, which all other COPs I've dumped do, since they use the L port for output. So I'll probably have to do the full method, which forces instructions to set the L port to output then jumps to near the end of ROM before switching to ROM dump mode.

I built a rig from an old JAMMA connector to give me access to the signals on the cart connector without soldering to it, then I tacked on the remaining wires to the test pads. But I must have something wrong because I should see a signal on the clock output and possibly the SK pin, but I'm not.