looks like I got M58846 dumping now. The bit order isn't 100% sure but it does look rather good. The initialization code appears to be 100% correct.

I found that the code uses 4 undefined opcodes- 008h, 009h, 018h, and 019h. There's plenty of others but only those show up. I found that the M58845 uses them for the ADC so I added them for that but they don't really make much sense. After tracing through the VFD update code, I'm 99% sure 018h is a left rotate or acc=acc+acc. (which is the same thing) The code here illustrates that:

Code
01-00    005                EI		;external interrupt vector
01-01    046                RTI
01-02    041                LCPS 1	;timer 1 interrupt vector
01-03    01A                TEAB	;move AB into E
01-04    0CC                LXY C	;point to RAM 0ch
01-05    064                TAM 0	;get memory in 0Ch (grid #)
01-06    00C                TYA		;old grid
01-07    014                RD		;turn off old grid
01-08    002                INY		;next grid #
01-09    03C                SEY #C	;is it 12? (there's 12 grids)
01-0A    1A5                B 25	;no
01-0B    0EC                LXY C	;address 0ch
01-0C    021                SZB 1	;do we read buttons?
01-0D    1A0                B 20	;do not read buttons
01-0E    0B1                LA #1	;check left+down buttons
01-0F    081                OFA		;acc to port F
01-10    04D                SB 1	;we read buttons

;buttons are on bits 0 and 1 of K port which is loaded into A
;via the IAK instruction.  bit 2 isn't used and bit 3 is skill.

01-11    0CD                LXY D	;L+D buttons go into 0dh
01-12    057                IAK		;read button register
01-13    060                XAM 0	;store in RAM
01-14    0B2                LA #2	;check up+right buttons
01-15    081                OFA		;acc to port F
01-16    05F                RB 3	;clear bits 2/3 of 0dh
01-17    05E                RB 2
01-18    048                RC		;clear carry
01-19    057                IAK		;read button register
01-1A    018                *XAL	;shift left I think
01-1B    048                RC		;clear carry
01-1C    018                *XAL	;shift left I think
01-1D    00A                AM		;add DL00 to 00RU in RAM 0dh
01-1E    060                XAM 0	;store into 0dh (DLRU buttons)
01-1F    1A4                B 24	;done

01-20    0E8                LXY 8	;if we do not read buttons
01-21    000                NOP		;waste time instead
01-22    002                INY
01-23    1A2                B 22	;loop

01-24    0C0                LXY 0	;fall thru (if grid = 12 sets to 0)
01-25    065                TAM 1	;get data at addr 0Y
01-26    01C                TBA		;put it into B
01-27    067                TAM 3	;get data at addr 1Y
01-28    01B                OSAB	;put it into A then output to port S
01-29    065                TAM 1	;get data at addr 2Y
01-2A    084                OGA		;output it to port G
01-2B    064                TAM 0	;get data at addr 3Y
01-2C    081                OFA		;output it to port F
01-2D    015                SD		;turn on grid Y (new grid)
01-2E    01D                TAY		;grid # into Y
01-2F    0CC                LXY C	;point to 0ch
01-30    060                XAM 0	;store grid # into 0ch

The full disassembly is here:

http://blog.kevtris.org/blogfiles/Handhelds/m58dxx.txt

and ROM is here (you only need 2K words, I dumped it a lot of times to make sure it dumped OK)

http://blog.kevtris.org/blogfiles/Handhelds/m58d.bin

these links will probably go dead when I finalize the ROM and put it into the proper /Coleco Frogger/ dir.