Well, some time has passed since we chatted about the VDP timings, and I think it'll try to make a small circuit in the protoboard to monitor the VDP signals. A (great) analysis was made for the v9938 (it's in grauw's website), but not directly with the v9918. If I'm not wrong, it assumes that for v9918 it's kind of the same, but with a slower clock.
My suspicion is that the v9918 has more access slots than we think, so I'll try to measure this directly.
My idea is to put the v9918 and an ESP32 in a protoboard, and monitor when it activates /CAS and to monitor at which moment it access the VRAM and to which address. I won't add any VRAM chips, I'll just read the address bits.
It doesn't seem really complicated, the ESP32 has a lot of I/O pins, and it's a matter of buffering and adaption the CMOS-NMOS levels, resetting the VDP, configuring the right addresses for the tables, be sure to be in a high-impedance state when the VDP is controlling the bus, saving everything in ESP's RAM and then reading it via the serial port. Not complicated a priori, but probably really time consuming 
I don't know if someone has already done any of this. If so, please tell me, because I don't want to do all the work for nothing 
If I get any interesting results I'll let you know. It can take quite long, anyway...
