Anything I missed?
Only to answer this question: what value does the OUT&H40,8: PRINT INP(&h40) return on your real FS-A1FM, and also OUT&H40,&HF7: PRINT INP(&h40)?
The FS-CM1 modem ROM seems to be the same or similar as the FS-A1FM modem ROM. It seems use some addresses between 7FC0h-7FCFh.
Another note: apparently Wouter already discovered almost 13 years ago that the openMSX implementation only used the first 1MB of the existing dump, see https://github.com/openMSX/openMSX/commit/5bfbc739127c8683f6...
In any case, is there any schematic of this machine available?
I tried and both times the value printed is 255.
Wouldn’t we be able to deduce the exact MASK ROM content from existing knowledge of the Panasonic Mapper in slot 3-3. I mean this mapper is used in the 2+ And tR machines. In many ways these machines were based on the work Panasonic did in the A1FM. If we dump these machines in the same way as I did on the FM and compare their results to known good mask rom dumps of the same machines we could extrapolate the FM ROM, right?