The v5f banner ran to 0x3018. I had cleared that window two ways, an instruction-operand scan and a runtime read-watch, and both said it was free. Both were wrong.

The font base addresses that reach into it live as data inside parameter blocks behind a pointer table at 0x0AFF, so no operand scan will ever see them, and my test jobs only ever selected the two font classes that do not point there. I had written over live glyph cells for @, A and B.

Result: constant BUSY on every interface, a crash-reset loop every few seconds, garbage on the rare moments it held still. A dead scan plus an incomplete test equals a bricked printer.

Nothing goes at or above 0x3000 now, and the build asserts it rather than trusting me to remember.