There is also flaw in the reasoning with the "instructon read as low address" scenario:

No. Remember, we would be "executing" from 8000h above; so 0102 is ajmp 8002h.
The next fetched bytes would be 02 03 04. That is ljmp 0304h.
If Little Joe erased the part before programming and programmed only the hexfile resulting from the translation, there are FFs from 0304 until the top of FLASH. Those are mov r7,a - pretty harmless. Reaching 2000h, it starts fetching from unconnected external code space, so according to your scenario, it fetches 00 01 02... again - which leads to an infinite loop.

Very nice try, lot of thoughts in it - but it is not it. Not this exact way.

I would rather consider the data read from an "unconnected" memory as random. Here is why: Little Joe used a (pretty uncommon) 74LS573 as a low-address latch, so P0 is loaded by its inputs. LS inputs are equivalent to a diode in series with a cca. 20kΩ pullup. So after address phase ends and P0 is floated, the lines which were previously at 0 start charging up. The input data are sampled approx. 3 clock times after floating P0, which is 125ns. If the P0+latch input+memory data output+PCB trace capacity is around 6pF (which is not quite unlikely), the time constant is so that the readback will be just uncertain.
Of course, with 74HC573 (and more memories/other devices/longer lines connected to the P0 bus) the picture changes and as now there is no significant pullup present, the capacity might hold the "low address" value long enough to be read back.


Jan Waclawek