What is still not settled. It is here so that what is missing can be seen, not hidden.
jp 0xBE2E in the headerAt 0x4015, right behind Konami's signature, there is a jp 0xBE2E. It is an entry point meant to be called by another cartridge, but it is not known who would jump there nor with which page mapped at 0xA000, so it is not known what code you would land in either.
Of the cartridge's 131,072 bytes, 504 are still marked as pending tracing: 0.4 %. It is not that nobody knows what they are —they sit inside identified blocks— it is that the tracer cannot reach them from any known entry point, so they cannot be safely declared code.
Besides the eight page-0 doors listed under findings, there is a handful of routines scattered through the other pages whose bytes never appear as the target of a jump. Some are clearly leftovers —variants of a routine next door— but for others it cannot be ruled out that they are reached through a computed address.
The car record is over a hundred bytes long and not all of them are tied to visible behaviour. The ones used in the arithmetic are clear —position, velocities, angle, gear, revs, fuel, wear— but there are counters and flags read in a single place whose purpose could not be stated without watching them run.
There is a table of sixteen pointers indexed by terrain, and all sixteen entries point to the same place. Either it is redundant, or it was left ready for a variation that never happened.
Eight bytes (04 01 04 01 02 04 02 01) between two routines with no caller, which nothing in the cartridge references.
CLOSED on 2026-09-15: this cartridge does not carry it. Manuel Pazos documented that Konami cartridges hide their RC7xx catalogue number and the katakana title at the end of the ROM. The question left open was whether it might be somewhere other than where we had looked, so this time every position was checked, not just the page ends: of the 201 0xAA bytes in the 131,072, none closes a block with the shape of the mark -a length of 4 to 32, an RC in BCD and a title in the house's katakana-, and the 52 of RC-752 does not turn up anywhere either. The same search does find it in the seventeen cartridges of the series that carry it.
A good part of what is written here comes from reading the code, not from watching it run. The things that have been checked in openMSX are marked as such in the disassembly notes; the rest is reading, and although it has been gone over twice, a third pass would keep turning things up. It has happened several times already.