>Of particular interest, I'm told that sometimes the NMOS reads from a
>garbage address, or writes a garbage value. I'm wondering if there is
>any way to calculate these values, or if they are truly random.
They're not truly random. Most of the time, instructions run at one cycle for each memory access they need. However, there are a few exceptions.
The one-byte two-cycle instructions fetch the next opcode during their second cycle.
Indexed reads that cross page boundaries read from the wrong address first. The low 8 bits of the address will be correct, but the high 8 bits have not been incremented.
Indexed writes always have the dead cycle. If a page boundary is crossed, they'll read from the wrong location (as above). If it is not crossed, the extra read is from the right location.
Read-modify-write instructions (like INC) read the original data, write it back, and then write the modified data.
Taken branches read the next opcode byte. Taken branches that cross a page boundary read the next opcode byte, then the wrong address (correct low 8 bits, current high 8 bits).
Some time ago I took traces of a few instructions with a logic analyser. These are from an NMOS 6510 in a C64.
http://www.ucc.gu.uwa.edu.au/~john
64doc contains more information than you could ever want to know.
http://www.atarihq.com/danb/files/64doc.txt