"EXT LATCH" would probably be the next one to target. It's probably using STAT78 and PIO for that.
EXT LATCH tests the horizontal latch at 0x213c (OPHCT) (puts it at work ram $0054-5 then checks with various values, put a breakpoint at pc=9226 to quickly check it). I can workaround it but it's directly related to the maincpu/pixel clock timings, so it'll do damage in the long term. Same goes for the VH flag test, in the end the fault is shared of that 256/512 switch thing that I've putted up that shows one of the major flaws in MAME/MESS architecture...
