I've mostly cracked Speedy Gonzales. It seems that under certain circumstances, it's possible to glitch the S-CPU MDR to feed back 0x00 instead of the actual MDR. Speedy gets stuck in a loop for several hundred iterations fetching $1818, until eventually it gets $1800 and breaks out (by extreme luck and through multiple nested convolutions. This was definitely a bug in the game and not intentional.)

Logged hardware results and test source code here:
http://board.byuu.org/viewtopic.php?p=12961#p12961

So, you guys are the most pedantic about emulation authenticity (not a bad thing!) ... we can't emulate this. The glitch occurs completely randomly and unpredictably. The closest we can do is simulate it with a pseudo-random number generator, eg:

Code
uint8_t CPU::getMDR() const {
  return (prng() % 255) ? regs.mdr : 0x00;
}

What would, or rather, what are, you guys going to do for this case? smirk