Quote:
As for a cart writing to the B bus, there's no way to request the CPU to leave off. The DMA unit does it via the RDY line on the 65816 core, which is not exposed on the 5A22.
Rather pedantic but worth noting, the 2A03 also utilizes the RDY line for DMC transfers. But of course the APU is internal to the CPU. By lowering the RDY line, it causes the CPU to pause and continuously read on the next read cycle. Then one can push a new address value onto the bus, overriding what is actually read. Restore the address prior to raising RDY again, and you can perform an injected read.
RDY does not suspend CPU writes, so even IF the cartridge bus was connected to RDY (it isn't), that could not be used to write to anything over the A bus.
If you had RDY on the cart bus, you MAY be able to strobe /PAWR and override the data bus. However, even then, unlike the 2A03 where only three consective writes are possible before a read, the 65816 can get in states where it never reads (STP), doesn't read for an entire frame (WAI), or doesn't read for ten frames (B->A DMA transfer of 64K bytes on all 8 channels.) If you wanted to stop the CPU for up to 167ms just to write to the B-bus, you could possibly do it IF you had that RDY line.
As it stands, if you touch that data bus you are going to end up with bus conflicts. The SNES cart and expansion ports were designed from the ground up to be READ-based devices that respond to the CPU (master.) As far as I know, it's the same for the NES. Only there you also have the PPU bus there, so you can do crazy stuff with how it returns CIRAM/CHR RAM.