Oh well, I can confirm now that it is a bug in EhBasic. I stepped my way through the cold start routine until the message "Memory size" is setup. It is copied to $FFF2! Sure enough if I turn on write protect for $b000-$ffff the simulator stops with "Protected area write attempt detected" So it worked for me, because there is RAM at $fff2. For you there is ROM and you won't see the message.
The problem seems to be here:
Code:
LAB_20DC
STX Sendh ; save string end high byte
LDA ssptr_h ; get string start high byte
;************
CMP #>Ram_base ; compare with start of program memory
;************
BCS LAB_RTST ; branch if not in utility area
; string in utility area, move to string memory
TYA ; copy length to A
JSR LAB_209C ; copy des_pl/h to des_2l/h and make string space A bytes
; long
LDX ssptr_l ; get string start low byte
LDY ssptr_h ; get string start high byte
JSR LAB_2298 ; store string A bytes long from XY to (Sutill)
; check for space on descriptor stack then ..
; put string address and length on descriptor stack and update stack pointers
LAB_RTST
LDX next_s ; get string stack pointer
CPX #des_sk+$09 ; compare with max+1
BNE LAB_20F8 ; branch if space on string stack
; else do string too complex error
LDX #$1C ; error code $1C ("String too complex" error)
LAB_20F5
JMP LAB_XERR ; do error #X, then warm start
It works when Ram_base is lower than the message in memory. When it is higher, it doesn't work in systems with ROM because the proper end of RAM has not yet been set (strings grow from top down).
I have to wrap my head arround this and see, if I can come up with a fix.