Today I made another discovery: those addresses like 27c1, 2800 etc. If you take a closer look at the memory configuration you will see, that the processor uses the whole port F as an address bus and port AD as address/data bus. BUT there's only 8kB of ROM connected to the CPU! Yeah, that must be it. Let's take a look at the schematic. Bingo! Lines AB13-AB15 (aka F13-F15) are connected to IC12 (40H139) which selects RAM, LED drivers or the output buffer to KLM-654 depending of the state of its inputs, the E pin and the /WR line of the CPU. If neither input is selected (i.e. lower addresses are used), IC12 pulls down the /CE pin of the ROM chip enabling it for normal read operations. Sooo, if we try to write to addresses above 2^13 (0x2000h) we will end up outputting the data somewhere else. Probably.