A few other questions as long as you have an ICE:
- Does writing values other than 0xC3 to 0xF88D do anything interesting? The binary 11000011 pattern makes me think it's just a magic constant, but it'd be interesting if the individual bits did something.
- Does the bus lock itself again after a certain amount of time? I noticed the disassembled program re-writes the 0xC3 unlock several times.