41CL: Plugging a Module from RAM rather than FLASH?

[burkhard]

In the course of working on the OSX3 problem I described on a different thread, it occurred to me it might occasionally be useful in debugging to upload an old version of a ROM from an old ROM zip file from the PC host → the 41CL. I assumed that once in the 41CL RAM, I should be able to have the MMU point to a RAM address (rather than a flash address) to find that ROM image. In this way, I'd be able to try an old version(s) of something without actually flashing back in old content.

So I tried to do this using clupdate's "upload" command and the YIMP command at the 41CL.
Rather than try OSX3 which is a bank-switched ROM I decided to instead practice with something simpler, CHEMUSER (CHEM) which is a single 4K page / single bank ROM.

PROCEDURE
1. I pulled CHEMUSER.ROM out of rom_files_180928.zip and placed it in the same working folder (Win7) as clupdate.
2. From mem_ref.pdf, it looked like the address range of 0x807000→0x80FFFF was free as User RAM and this would be a safe place for me to play. I hadn't myself knowingly put anything there, so I figured anywhere in there would be OK.
3. I chose 0x80F000→0x80FFFF to import the 4K CHEMUSER
4. In ALPHA, I entered 80F000-0FFF to set both the start address and the total length of file (minus 1)
5. I executed SERINI followed by BAUD48 at the 41CL
6. From a DOS command window on the PC, I ran java -jar clupdate-1.1.0.jar --upload CHEMUSER.ROM COM1 4800
7. I then quickly executed YIMP on the 41CL
8. Everything seemed to transfer OK (all 4K words... 8192 bytes in total), and clupdate reported a CRC of 0x03DE24BE, which was correct per mem_ref.pdf.
9. I decided to run YCRC on what made it into RAM to see if that was correct. I stuck 80F into ALPHA and then executed YCRC. No luck--it was a totally different number.
10. I pressed on ahead and decided to try to plug and run it anyhow. I put "–80F B" into ALPHA in order to point the MMU Page B to a single page starting at RAM physical address 0x80F000 and then executed PPLUG. It gave no error.
11. Running CAT2 I saw nothing new. Running PGCAT, it now showed "B: " (with nothing following the colon) rather than "B: NO ROM". It did not say "B: CHEMUSER" as I might have hoped...
12. I have tried repeating things, but now when I attempt to upload from PC → 41CL using YIMP exactly as before, I immediately get (no delay) the error OVERRUN, which I don't know how to solve.

QUESTIONS
a. Is the basic idea of plugging a ROM into the MMU from RAM rather than FLASH a sound one?
b. Did I do some procedural error?
c. Why is the CRC of the file that left the PC correct, but that stored in RAM not? I know a page of "00" yields a different CRC than a page of "FF". Should I have "initialized" the RAM with all FF or something like that before the XEQ YIMP? (rationale: I'm not sure if YIMP takes everything or just what isn't empty so maybe starting with all FF is better).
d. Why did subsequent re-attempts yield an immediate "OVERRUN" displayed on the 41CL?
e. How do I recover from these persistent OVERRUNs?

Thanks!