Login
Plus/4 EncyclopediaFirstBackNextLast

$FF28 Bug
Category
Programming/General Reference/KERNAL History

Topic
When performing a disk operation, sometimes the bytes $28 and $FF get written into the memory. Often it's location $304C or $3058, but it could be other places as well.

It is caused by a conflict between the TEDMON assembly mode and the BASIC DS$ disk status system variable.

When the DS or DS$ variable* is called upon in BASIC, the resulting DS$ string is allocated an area of memory 40 bytes long (regardless of the actual string length) at the end of the available BASIC memory area, and the actual string length is saved in $79 and the string memory location is saved at $7A-$7B. Whenever a disk drive operation is started from BASIC, it checks for the memory allocation of the string, and if it exists, de-allocates it by writing $FF28 to the end of the allocated string area ($FF=indicates garbage, $28=length of garbage) and setting the string length in $79 to zero.
*Calling DS will automatically create a DS$ string.

In TEDMON assembly mode, whenever an instruction longer than an accumulator or implied instruction is entered (more than 3 characters), the memory locations $79 onward are used as a buffer for non-hexadecimal characters (such as the $, #$ or ($ characters), with unused locations filled with the ASCII '0' code ($30). This causes BASIC to incorrectly assume that a DS$ string area is allocated in memory, and attempts to de-allocate it by writing $FF28 to the corrupted memory location when a disk operation is started.

The corrupted memory location is determined by the 5th and 6th characters in the assembly instruction, not including spaces.
For example:
- If the instruction was LDA $D0,X or STA $FF3F, the dollar sign ASCII code is passed to $79, and as the 5th and 6th characters are hexadecimal characters, they are ignored and the buffer at $7A-7B is filled with ASCII '0' $30. After adding the DS$ allocated string length of 40 characters ($28+$3030), the corrupted memory location is $3058.
- If the instruction was LDA #$FF or STA ($9B),Y, the hash sign or bracket ASCII code is passed to $79, the dollar sign ASCII code $24 is passed to $7A, followed by $30 into $7B for the hexadecimal character. After adding the DS$ allocated string length of 40 characters ($28+$3024), the corrupted memory location is $304C.

Other memory locations can be corrupted if there was a typing error in the assembly line.

The fix is mentioned in a few Hungarian diskmags:
Terror News 01 (1990), Terror News 16 (1991), New$Reel #10 (1994)

Before performing any disk operation in BASIC, enter the following:
In TEDMON:
>79 00
In BASIC:
POKE121,0 or CLR.

KERNAL patch:
forum/45313




Keywords
FF28 bug, 28 FF 

Credits
SVS 



Copyright © Plus/4 World Team, 2001-2025. Support Plus/4 World on Patreon