Ok, thanks for the link.

With MESS 0.135, c65 works.

Code execution starts at 0xE4B8, instead of 0x0000 with version 0.149, and there is meaningful code at 0xE4B8.