These 2 combined fix #418:

1) Uthernet card now returns floating bus for slot ROM at $Cs00-CsFF (where s=3).
2) Fixed IoHandlerCardsIn() to not map in the card in slot3's slot ROM when SLOTC3ROM=0.

Also:
. moved the typedef 'iofunction' from common.h to memory.h

source/Common.h

@@ -141,9 +141,6 @@ enum AppMode_e
 #define WM_USER_FULLSCREEN	WM_USER+9
 #define VK_SNAPSHOT_TEXT	WM_USER+10 // PrintScreen+Ctrl
 
-// TODO-TC: Refactor codebase by renaming /nCyclesLeft/ to /uExecutedCycles/
-typedef BYTE (__stdcall *iofunction)(WORD nPC, WORD nAddr, BYTE nWriteFlag, BYTE nWriteValue, ULONG nCyclesLeft);
-
 enum eIRQSRC {IS_6522=0, IS_SPEECH, IS_SSC, IS_MOUSE};
 
 //

source/Memory.cpp

@@ -25,7 +25,7 @@ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  *
  * Author: Various
  *
- * In comments, UTA2E is an abbreviation for a reference to "Understanding the Apple //e" by James Sather
+ * In comments, UTAIIe is an abbreviation for a reference to "Understanding the Apple //e" by James Sather
  */
 
 #include "StdAfx.h"
@@ -340,7 +340,7 @@ static BYTE __stdcall IORead_C06x(WORD pc, WORD addr, BYTE bWrite, BYTE d, ULONG
 {	
 	static byte CurrentKestroke = 0;
 	CurrentKestroke = KeybGetKeycode();
-	switch (addr & 0x7) // address bit 4 is ignored (UTA2E page 7-5)
+	switch (addr & 0x7) // address bit 4 is ignored (UTAIIe page 7-5)
 	{
 	//In Pravets8A/C if SETMODE (8bit character encoding) is enabled, bit6 in $C060 is 0; Else it is 1
 	//If (CAPS lOCK of Pravets8A/C is on or Shift is pressed) and (MODE is enabled), bit7 in $C000 is 1; Else it is 0
@@ -524,6 +524,20 @@ static bool IsCardInSlot(const UINT uSlot);
 
 // NB. ProDOS boot sets IO_SELECT=0x04 (its scan for boot devices?), as slot2 contains a card (ie. SSC) with an expansion ROM.
 
+//
+// -----------
+// UTAIIe:5-28
+//                       $C100-C2FF
+// INTCXROM(*) SLOTC3ROM $C400-CFFF $C300-C3FF
+//    0           0         slot     internal
+//    0           1         slot       slot
+//    1           0       internal   internal
+//    1           1       internal   internal
+//
+// (*) SLOTCXROM'
+// -----------
+//
+
 BYTE __stdcall IORead_Cxxx(WORD programcounter, WORD address, BYTE write, BYTE value, ULONG nCyclesLeft)
 {
 	if (address == 0xCFFF)
@@ -731,9 +745,11 @@ void RegisterIoHandler(UINT uSlot, iofunction IOReadC0, iofunction IOWriteC0, io
 	ExpansionRom[uSlot] = pExpansionRom;
 }
 
-// TODO: Support SW_SLOTC3ROM?
+// From UTAIIe:5-28: Since INTCXROM==1 (SLOTCXROM==0) then state of SLOTC3ROM is not important
 static void IoHandlerCardsOut(void)
 {
+	_ASSERT( !SW_SLOTCXROM );	// INTCXROM==1
+
 	for (UINT uSlot=1; uSlot<NUM_SLOTS; uSlot++)
 	{
 		for (UINT i=0; i<16; i++)
@@ -744,15 +760,26 @@ static void IoHandlerCardsOut(void)
 	}
 }
 
-// TODO: Support SW_SLOTC3ROM?
 static void IoHandlerCardsIn(void)
 {
+	_ASSERT( SW_SLOTCXROM );	// INTCXROM==0
+
 	for (UINT uSlot=1; uSlot<NUM_SLOTS; uSlot++)
 	{
+		iofunction ioreadcx  = g_SlotInfo[uSlot].IOReadCx;
+		iofunction iowritecx = g_SlotInfo[uSlot].IOWriteCx;
+
+		if (uSlot == 3 && !SW_SLOTC3ROM)
+		{
+			// From UTAIIe:5-28: If INTCXROM==0 (SLOTCXROM==1) && SLOTC3ROM==0 Then $C300-C3FF is internal ROM
+			ioreadcx  = IORead_Cxxx;
+			iowritecx = IOWrite_Cxxx;
+		}
+
 		for (UINT i=0; i<16; i++)
 		{
-			IORead[uSlot*16+i]	= g_SlotInfo[uSlot].IOReadCx;
+			IORead[uSlot*16+i]	= ioreadcx;
-			IOWrite[uSlot*16+i]	= g_SlotInfo[uSlot].IOWriteCx;
+			IOWrite[uSlot*16+i]	= iowritecx;
 		}
 	}
 }
@@ -1020,6 +1047,11 @@ void MemDestroy()
 
 //===========================================================================
 
+bool MemCheckSLOTC3ROM()
+{
+	return SW_SLOTC3ROM ? true : false;
+}
+
 bool MemCheckSLOTCXROM()
 {
 	return SW_SLOTCXROM ? true : false;
@@ -1734,7 +1766,8 @@ _done_saturn:
 	{
 		modechanging = 0;
 
-		if ((lastmemmode & MF_SLOTCXROM) != (memmode & MF_SLOTCXROM))
+		// NB. Must check MF_SLOTC3ROM too, as IoHandlerCardsIn() depends on both MF_SLOTCXROM|MF_SLOTC3ROM
+		if ((lastmemmode & MF_SLOTCXROM|MF_SLOTC3ROM) != (memmode & MF_SLOTCXROM|MF_SLOTC3ROM))
 		{
 			if (SW_SLOTCXROM)
 			{

source/Memory.h

@@ -46,6 +46,10 @@ enum MemoryType_e
 	MEM_TYPE_SATURN   = 2,
 	NUM_MEM_TYPE      = 3
 };
+
+// TODO-TC: Refactor codebase by renaming /nCyclesLeft/ to /uExecutedCycles/
+typedef BYTE (__stdcall *iofunction)(WORD nPC, WORD nAddr, BYTE nWriteFlag, BYTE nWriteValue, ULONG nCyclesLeft);
+
 extern MemoryType_e	g_eMemType;
 
 extern iofunction IORead[256];
@@ -69,6 +73,7 @@ extern UINT g_uSaturnActiveBank;		// Saturn 128K Language Card Bank 0 .. 7
 void	RegisterIoHandler(UINT uSlot, iofunction IOReadC0, iofunction IOWriteC0, iofunction IOReadCx, iofunction IOWriteCx, LPVOID lpSlotParameter, BYTE* pExpansionRom);
 
 void    MemDestroy ();
+bool	MemCheckSLOTC3ROM();
 bool	MemCheckSLOTCXROM();
 LPBYTE  MemGetAuxPtr(const WORD);
 LPBYTE  MemGetMainPtr(const WORD);

source/Tfe/Tfe.cpp

@@ -42,9 +42,9 @@
 #define NULL 0
 #endif
 typedef unsigned int UINT;
-#include "..\common.h"
+
-// Define here, so we don't drag in the whole of stdafx.h:
+#include "..\Common.h"	// For: IS_APPLE2
-void RegisterIoHandler(UINT uSlot, iofunction IORead16, iofunction IOWrite16, iofunction IOReadCx, iofunction IOWriteCx, LPVOID lpSlotParameter, BYTE* pExpansionRom);
+#include "..\Memory.h"
 
 /**/
 /** #define TFE_DEBUG_DUMP 1 **/
@@ -392,6 +392,7 @@ void tfe_debug_output_pp( void )
 /* ------------------------------------------------------------------------- */
 /*    initialization and deinitialization functions                          */
 
+BYTE __stdcall TfeIoCxxx (WORD programcounter, WORD address, BYTE write, BYTE value, ULONG nCycles);
 BYTE __stdcall TfeIo (WORD programcounter, WORD address, BYTE write, BYTE value, ULONG nCycles);
 
 void tfe_reset(void)
@@ -454,7 +455,7 @@ void tfe_reset(void)
     }
 
 	const UINT uSlot = 3;
-	RegisterIoHandler(uSlot, TfeIo, TfeIo, NULL, NULL, NULL, NULL);
+	RegisterIoHandler(uSlot, TfeIo, TfeIo, TfeIoCxxx, TfeIoCxxx, NULL, NULL);
 }
 
 #ifdef DOS_TFE
@@ -1501,6 +1502,28 @@ int tfe_enumadapter_close(void)
     return tfe_arch_enumadapter_close();
 }
 
+// Go via TfeIoCxxx() instead of directly calling IO_Null() to include this specific (slot-3) _DEBUG check
+static BYTE __stdcall TfeIoCxxx (WORD programcounter, WORD address, BYTE write, BYTE value, ULONG nCycles)
+{
+#ifdef _DEBUG
+	if (!IS_APPLE2)
+	{
+		// Derived from UTAIIe:5-28
+		//
+		// SLOTCXROM SLOTC3ROM TFE floating bus?
+		//   1         0         N (internal ROM)
+		//   1         1         Y
+		//   0         0         N (internal ROM)
+		//   0         1         N (internal ROM)
+		if (! (MemCheckSLOTCXROM() && MemCheckSLOTC3ROM()) )
+		{
+			_ASSERT(0);	// Card ROM disabled, so IORead_Cxxx() returns the internal ROM
+		}
+	}
+#endif
+
+	return IO_Null(programcounter, address, write, value,nCycles);
+}
 
 static BYTE __stdcall TfeIo (WORD programcounter, WORD address, BYTE write, BYTE value, ULONG nCycles)
 {

test/TestCPU6502/TestCPU6502.cpp

@@ -2,6 +2,7 @@
 
 #include "../../source/Applewin.h"
 #include "../../source/CPU.h"
+#include "../../source/Memory.h"
 
 // From Applewin.cpp
 bool g_bFullSpeed = false;