Thanks, FitzRoy spotted it in-game. The most insidious part is that an emulator would never even know about it. They wouldn't see the shadow line and would think the game was perfect. Hence why I mentioned it here
This game just so happened to hit right between the exact point where I render the scanline, so my entire scanline ended up darkened, making it stand out big-time.
You guys probably also know about Uniracers, but if not ... that one writes to OAM during Hblank in 2-player mode. The S-PPU is controlling the OAM address at this time, and the last fetched sprite data is where the write ends up going. But that one's a lot easier to deal with since it writes during Hblank where the position is stable.