Yeah, I know that Low G Man reads from open bus during the stage 1&2 boss music (and possibly for other music as well). If it only reads #$00 instead from $6000-$7FFF, the game will get stuck in the music play routine (hence why it freezes there in some emulators). I had to patch the music play routine to account for this when ripping the NSF.
In Low G Man, the section of the music code that does this is:
Code:
$80A5: LDA $8353,Y
$80A8: STA $01
$80AA: LDY $0D,X
$80AC: LDA ($00),Y ; here is where the open bus read happens
$80AE: CMP #$30
For the patch I did:
Code:
$80A5: JMP _somewhere
$80A8: STA $01
$80AA: LDY $0D,X
$80AC: LDA ($00),Y
$80AE: CMP #$30
_somewhere:
LDA $8353,Y
STA $01
LDY $0D,X
CMP #80 ; test high byte of address at $00-$01
BMI (+3) ; if address is below $8000, ignore instruction at $80AC, leaving accumulator unchanged*
JMP $80AC
JMP $80AE
*as the accumulator has stored the high byte of the $6000-$7FFF address.
I wonder if this is the only place where the open bus read happens in the game.