--- a/bootrom.notes	Wed Apr 24 22:48:12 2013 +0000
+++ b/bootrom.notes	Wed Apr 24 23:49:39 2013 +0000
@@ -90,9 +90,15 @@
 800108: byte initialized to 0x01
 80010C: all bytes of a '<w' command after these two command chars
 	are stored starting here
+	this buffer is also used for other scratchpad functions: <p
+	command bytes, all response messages
 80050B: the above buffer ends here
 
+The group of vars starting at 800518 may have been envisioned
+as a struct - see the routine at 0x11c:
+
 800518:	byte variable receives the first parameter byte after '<p'
+	init to 04 by '<i'
 80051C: 32-bit var set by the '<p' command
 800520: byte variable filled every time the 0xfb4 routine is called
 	holds the ID of the UART on which '<' came in, or FF if none
@@ -101,15 +107,19 @@
 800524: byte variable filled every time the 0xfb4 routine is called
 	filled with a copy of 800534
 800525:	byte var set by the '<p' command
+800526: 16-bit var init to 0 by 0x11c ('<i' handler)
+	byte following the '<c' command is extended to a half-word and
+	written here
+800528: 16-bit var init to 0 by 0x11c ('<i' handler)
 
-80052C: byte following the '<c' command is extended to a half-word and
-	written here
+80052C:	32-bit var init to 0 by 0x11c ('<i' handler)
+	word holds the argument of the '<b' command
+800530: byte indicates validity of the received '<w' command:
+	0 means valid, 1 means something bad
+	init to 0 by 0x11c
 
 800534: byte initialized to 0x00, then may be set to 1 by the 0xfb4
 	routine if it selects /1 clock mode.
-800538: word holds the argument of the '<b' command
-80053C: byte indicates validity of the received '<w' command:
-	0 means valid, 1 means something bad
 
 8005C0: appears to be the intended low address (bottom) of the stack
 80074C: top of the stack (initial value loaded into SP)