My Miuchuz memory explorer revealed that the reverse engineering effort's OTP dump was actually shifted a little bit, so I fixed the shifting and now it actually makes a lot more sense (the values in the vector area look like vectors now). I also worked out the logic behind what external addresses map in what devices.

I love that the program that's been helping answer questions about the handheld still boots up to a drawing of me hehe.