The cartridge

16,384 bytes, anchored in page 2 (0x8000-0xBFFF). All 16,384 are accounted for, and they break down like this:

range	bytes	what it is
0x8000-0x800F	16	the AB header
0x8010-0xA360	9,041	the MSX-BASIC program, tokenised
0xA362-0xAFFF	3,231	the interpreter's variable table
0xB000-0xBF9F	4,000	the course data: all nine holes
0xBFA0-0xBFFF	96	nothing: nobody reads them

The header declares TEXT and nothing else

41 42 00 00 00 00 00 00 10 80 00 00 00 00 00 00
 A  B   INIT   STATEMENT   TEXT=0x8010   DEVICE

INIT zero, STATEMENT zero, DEVICE zero. The only thing the cartridge says is TEXT=0x8010, meaning "there is a BASIC program here, run it". And the interpreter runs it from the ROM itself, without copying it to RAM.

The program

246 lines, 718 statements, 9,041 tokenised bytes. Not one CALL or USR to real machine code: the only call, USR(0) in line 30000, points at address 0, so pressing STOP resets the machine.

The variable table: the boot trick

Between the program and the course data sit 3,231 bytes that are neither code nor authored data: they are the interpreter's variable tables, exactly as they were left in memory during a real session of the game. That is the trick that lets a BASIC cartridge with no INIT routine boot at all: the ROM carries the program and its state already set up.

tools/variables.py reads them. Out come 98 plain variables (0xA362 to 0xA728) and nine arrays (0xA729 onwards), in the same order the program creates them. And the session frozen inside was playing hole 2:

H  = 2        the hole
ZM = 0xB37A   the course read pointer, already on hole 3
HX = 60       hole 2's flag...
HZ = 139      ...with line 117's one-metre adjustment already taken off
P  = 3        its par
S8 = 12       twelve strokes in all, eleven of them on hole 1

That those figures agree with the course data is a check on the reading done from outside the program, and it is wired up as a test.

The last array does not fit: C1() starts at 0xAFA1 and would need 25 bytes more than are left. From 0xB000 on comes the course data, and it eats the rest. It does not matter: the interpreter rebuilds all those arrays when it runs the DIM in line 20.

The course data

Exactly 4,000 bytes, from 0xB000 to 0xBF9F, with the nine holes packed one behind the other. How they are read is in Findings.

hole	address	bytes		hole	address	bytes
1	0xB000	532		6	0xB8BC	444
2	0xB214	358		7	0xBA78	438
3	0xB37A	446		8	0xBC2E	408
4	0xB538	452		9	0xBDC6	474
5	0xB6FC	448