mkarcher wrote on Yesterday, 12:50:
I did not yet get around to trace follow the traces on the EGA card, but assuming that the PEGA2A chip has D0..D7 multiplexed with A0..A7 and the multiplexing happens with buffers like 74LS244 controlled by the PALs, a single misbehaving PAL could cause an address/data conflict locally on that card.
OK, so the data lines from the ISA bus are connected to U28 (74LS245) side B. It's not clearly visible whether the traces on the top side of the board "above" U28 going "left" (away from the bracket) are connected there as well, which would continue the unbuffered ISA data lines. Whether those traces are buffered or unbuffered: The top four data bits are connected to the inputs of the 4-bit Flip-Flop U13 (74LS173), and continue to the 8 vias near the "L208801A" label. The traces then continue on the solder side to U18 (another 74LS245), again on the "B" side, where those traces likely end.
U28 pin 19 (/OE) is permanently enabled. Clue: It is connected with a wide trace, so that trace very likely is +5V or GND. Direction control of that chip (pin 1) is not easily traceable from the photos. U18 /OE seems to be connected to pin 10 of U22 (74LS04). That chip is a hex inverter, the corresponding input is pin 11. Pin 11 is connected to a via below U22, which makes tracing that trace on the component side impossible, but it seems likely to be controlled by the PAL U10 next to U22. The direction control pin of U18 (the second 74LS245 possibly connected to the ISA data lines) seems to be connected to some pin of the PEGA2A. Possibly, U28 is a data buffer chip for the parallel port part of the card and U18 is a data buffer chip for the EGA part of the card.
The A side of U28 (the suspected data buffer for the parallel port) is connected to the inputs of U31 (74LS374), an 8-bit flip-flop, likely the data latch for the parallel port. In a classic parallel port implementation, U30 (the 74LS244 2*4-bit unidirectional bus driver above it) would be the chip to read back the data from the pins at the parallel port, the 74LS174 next to it would be the latch for the control pins, one part of U24 (74LS125) is the IRQ7 driver, and one half of U29 (a 74LS240 inverting 2*4-bit unidirectional driver) may be used to read back the status bits. I'm not going to look into that part in more detail.
ISA address lines A0..A19 are routed at the lower edge of the component side of the card. Furthermore A0..A9 (the address bits used for I/O addresses) are tapped near the ISA connector. A8, A10..A13 have vias below U23. After those vias, the block of address lines splits. A0..A13 continue towards the ROM chip (the EGA BIOS is 16K, and 14 address lines are enough to address it), while the higher address lines move towards U11 (but some disappear in a via before reaching U11 on the component side). It seems the address and data bits at the ROM are mostly connected to the address and data bits of the 2K SRAM (which is used for legacy emulation; some CGA/MDA I/O writes like 3D8 are mirrored in hardware into that RAM). As the SRAM is quite close to the ROM, damage in that chip can easily disturb the ROM. You don't need that chip for the BIOS to be readable, so one thing you can try is to remove U15 (the 2K SRAM) and try dumping the BIOS again. If that helps, either the SRAM is broken itself, or it gets bad control signals that cause it to disturb ROM reads.
Meanwhile, I will continue to trace the card to see whether I can find something that is able to "accidentally" short address to data bits.