Post-Boot State

At the first PC=0x0100 instruction fetch after the real DMG boot ROM, the machine is in a single, fully-measured hardware state. This chapter pins that state — to the edge, because "PC=0x0100" is ambiguous without it — and gives skip-boot emulators the exact values to adopt.

The anchor, precisely. Under SM83 fetch overlap, the boot ROM's terminating LDH (FF50),A performs its post-body fetch in the same physical M-cycle as the cartridge instruction's first fetch. The anchor is the CLK9 edge that opens that M-cycle: cpu_port_a transitions to 0x0100, reg_pc holds 0x0100, the FF50 write committed in the prior M-cycle, and the M-cycle counter reads m7 (the post-body fetch state — interrupt dispatch).

Anchoring at LDH's mid-write instead places the CPU 3 dots early and propagates a CPU/PPU phase error through everything downstream (dmg-sim measurement, picosecond-identical across three captures).

The handoff lands deep in the first scanline's Mode 0 — LX = 98 of 113, 15 M-cycles before LINE_END — with the OAM scan long complete (scan counter at its terminal 39).

PPU state

CPU-visible registers

CPU dispatch chain

Every dispatch-chain cell is idle (measured, picosecond-identical across three captures): no dispatch in flight, nothing latched, the per-bit IF&IE latches all reading "not pending", and — the one that matters — IME is DISABLED (ime_n = 1). Skip-boot initialisers that set IME=1 contradict the measured handoff.

The divider, exactly

reg_div16 = 0xEAF3 at the anchor (settling from 0xEAF2 just after the boundary edge — bit 0's normal toggle, not a cascade). DIV = bits [13:6] = 0xAB.

Three subtleties:

1. FF04 alone under-constrains the state. The low six bits (0x33) are software-observable through TIMA-increment phase; an emulator matching FF04 but not reg_div16 diverges on the timer-phase test family. Pre-load the full 0xEAF3.
2. The simulation's bit 15 is a harness artifact. The boot-ROM execution measurement shows reg_div16 = (0x8000 + M-cycles) mod 2^16 because the sim deasserts the divider reset ~32,768 M-cycles before the CPU starts; real hardware would read 0x6AF3. The difference is invisible to all software (no bit-15 consumer), so either value is correct — but know which convention you are matching.

For boot-ROM-executing emulators: the total is 5,860,082 M-cycles from reset deassert to the anchor (dmg-sim measurement with the real boot ROM), with a per-PC checkpoint table dominated by the VRAM clear (~57k), the logo scroll (~4.25M), and the jingle wait (~1.4M). One sampling caveat carries over: several checkpoint PCs are byte-fetch transients of multi-byte instructions, so comparisons must use literal per-byte PC advance, not instruction-boundary semantics.

APU state

The boot ROM powers the APU, configures CH1, triggers it twice for the chime, and lets the envelope decay to silence. Measured at the anchor with the real boot ROM (dmg-sim measurement):

CH1 — the load-bearing block for the init_pos test family:

A skip-boot emulator that zeroes CH1's internals diverges from hardware on the whole retrigger test family: the first cartridge trigger reloads the divider but preserves the duty counter and the running latch, so audibility depends on duty step 2 advancing (or not) during the test's padding.

CH2/CH3/CH4 — untouched: counters zero (a simulation convention; the no-reset divider cells are undefined on silicon but unreachable before a trigger), DACs off, disable latches set. CH4's LFSR holds its 0x7FFF reset pattern. Wave RAM has no reset — the all-zero reading is a simulator initialisation, not a hardware claim; real post-boot wave RAM is implementation-defined.