Later note - Went away from this approach...

Using a binary counter for the wait states is not a good idea. The reason is that counters when decoded have noise when they transition. That's because they transition more than one bit at a time.

The classical solution to this problem is to use a grey counter which only changes one bit at a time. It does count strangely when viewed as numbers but it's much easier to decode and it is glitch-free.

Here's a 4 bit grey count:

0000 -> 0001
0001 -> 0011
0011 -> 0010
0010 -> 0110
0110 -> 0111
0111 -> 1111
...

Here is the logic analyzer capture:

Unfortunately the flakey S record load at 25 MHz happened again. Dropping back to 16.7 MHz fixed it again. Still haven't fixed the edge condition....

Timing to access external SRAM.