@@ -264,6 +264,14 @@ FLASHMEM void HandleExecution()
             Printf_dbg("\n Chp# Length    Type  Bank  Addr  Size\n");
             while (MenuSelCpy.Code_Image + MenuSelCpy.Size - ptrChipOffset > 1) //allow for off by 1 sometimes caused by bin2header
             {
+               const size_t Remaining = MenuSelCpy.Code_Image + MenuSelCpy.Size - ptrChipOffset;
+               if (Remaining < CRT_CHIP_HDR_LEN ||
+                   toU16(ptrChipOffset+0x0E) > Remaining-CRT_CHIP_HDR_LEN)
+               {
+                  FreeCrtChips();
+                  IO1[rwRegNextIOHndlr] = EEPROM.read(eepAdNextIOHndlr);
+                  return;
+               }
                if (!ParseChipHeader(ptrChipOffset, "")) //sends error messages
                {
                   FreeCrtChips();
@@ -496,7 +504,11 @@ bool LoadFile(FS *sourceFS, const char* FilePath, StructMenuItem* MyMenuItem)
       }
 
       //load header and parse
-      for (count = 0; count < CRT_MAIN_HDR_LEN; count++) lclBuf[count]=myFile.read(); //Read main header
+      if (myFile.read(lclBuf, CRT_MAIN_HDR_LEN) != CRT_MAIN_HDR_LEN)
+      {
+         myFile.close();
+         return false;
+      }
       MyMenuItem->Code_Image = lclBuf;
       if (!ParseCRTHeader(MyMenuItem, &EXROM, &GAME)) //sends error messages
       {
@@ -510,7 +522,17 @@ bool LoadFile(FS *sourceFS, const char* FilePath, StructMenuItem* MyMenuItem)
       Printf_dbg("\n Chp# Length    Type  Bank  Addr  Size\n");
       while (myFile.available())
       {
-         for (count = 0; count < CRT_CHIP_HDR_LEN; count++) lclBuf[count]=myFile.read(); //Read chip header
+         if (myFile.size() - myFile.position() < CRT_CHIP_HDR_LEN ||
+             myFile.read(lclBuf, CRT_CHIP_HDR_LEN) != CRT_CHIP_HDR_LEN ||
+             toU16(lclBuf+0x0E) > myFile.size() - myFile.position())
+         {
+            SendMsgPrintfln("Truncated CRT CHIP packet");
+            myFile.close();
+            FreeCrtChips();
+            IO1[rwRegNextIOHndlr] = EEPROM.read(eepAdNextIOHndlr);
+            RedirectEmptyDriveDirMenu();
+            return false;
+         }
          if (!ParseChipHeader(lclBuf, FullFilePath)) //sends error messages
          {
             myFile.close();
@@ -519,7 +541,16 @@ bool LoadFile(FS *sourceFS, const char* FilePath, StructMenuItem* MyMenuItem)
             RedirectEmptyDriveDirMenu();
             return false;        
          }
-         for (count = 0; count < CrtChips[NumCrtChips].ROMSize; count++) CrtChips[NumCrtChips].ChipROM[count]=myFile.read();//read in ROM info:
+         if (myFile.read(CrtChips[NumCrtChips].ChipROM, CrtChips[NumCrtChips].ROMSize) != CrtChips[NumCrtChips].ROMSize)
+         {
+            // The current allocation is owned even when its payload read fails.
+            NumCrtChips++;
+            myFile.close();
+            FreeCrtChips();
+            IO1[rwRegNextIOHndlr] = EEPROM.read(eepAdNextIOHndlr);
+            RedirectEmptyDriveDirMenu();
+            return false;
+         }
          NumCrtChips++;
       }
 
@@ -695,6 +726,7 @@ void FreeCrtChips()
 { //free chips allocated in RAM2 and reset NumCrtChips
    for(uint16_t cnt=0; cnt < NumCrtChips; cnt++) 
       if((uint32_t)CrtChips[cnt].ChipROM >= 0x20200000) free(CrtChips[cnt].ChipROM);
+   free(CrtChips); CrtChips = NULL;
    NumCrtChips = 0;
 }
 
 
@@ -18,8 +18,25 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 uint8_t *ptrRAM_ImageEnd = NULL; // Made global for REU access 
-uint8_t NumCrtChips = 0;
-StructCrtChip CrtChips[MAX_CRT_CHIPS];
+uint16_t NumCrtChips = 0;
+bool LoadedEasyFlashROM = false;
+StructCrtChip *CrtChips = NULL;
+// Reserve cartridge metadata in RAM2 only while a CRT is loaded.
+bool EnsureCrtChipTable()
+{
+   if (!CrtChips)
+   {
+      const uint16_t Capacity = LoadedEasyFlashROM ? MAX_CRT_CHIPS : MAX_LEGACY_CRT_CHIPS;
+      CrtChips = (StructCrtChip*)calloc(Capacity, sizeof(StructCrtChip));
+      if (!CrtChips && DriveDirMenu != NULL)
+      {
+         // Match the ROM-payload allocator: a large listing may occupy RAM2.
+         FreeDriveDirMenu();
+         CrtChips = (StructCrtChip*)calloc(Capacity, sizeof(StructCrtChip));
+      }
+   }
+   return CrtChips != NULL;
+}
 char* StrSIDInfo;  // allocated to RAM2 via StrSIDInfoSize
 char* LatestSIDLoaded; // allocated to RAM2 via MaxPathLength
 char StrMachineInfo[21] = ""; //~3 extra
@@ -52,6 +69,7 @@ bool ParseCRTHeader(StructMenuItem* MyMenuItem, uint8_t *EXROM, uint8_t *GAME)
    // https://vice-emu.sourceforge.io/vice_17.html#SEC369
    // http://ist.uwaterloo.ca/~schepers/formats/CRT.TXT
 
+   if (MyMenuItem->Size < CRT_MAIN_HDR_LEN) return false;
    uint8_t* CRT_Image = MyMenuItem->Code_Image;
 
    SendMsgPrintfln("Parsing CRT File");
@@ -74,6 +92,7 @@ bool ParseCRTHeader(StructMenuItem* MyMenuItem, uint8_t *EXROM, uint8_t *GAME)
    SendMsgPrintfln("Ver: %02x.%02x", CRT_Image[0x14], CRT_Image[0x15]);
 
    uint16_t HWType = toU16(CRT_Image+0x16);
+   LoadedEasyFlashROM = HWType == Cart_EasyFlash;
    SendMsgPrintfln("HW Type: %d ($%04x)", (int16_t)HWType, HWType);
 
 
@@ -117,6 +136,9 @@ bool ParseCRTHeader(StructMenuItem* MyMenuItem, uint8_t *EXROM, uint8_t *GAME)
 
 bool ParseChipHeader(uint8_t* ChipHeader, const char *FullFilePath)   
 {
+   // Other handlers retain their existing 128-CHIP limit.
+   if (NumCrtChips >= (LoadedEasyFlashROM ? MAX_CRT_CHIPS : MAX_LEGACY_CRT_CHIPS) ||
+       !EnsureCrtChipTable()) return false;
 
    if (memcmp(ChipHeader, "CHIP", 4)!=0)
    {
@@ -129,6 +151,21 @@ bool ParseChipHeader(uint8_t* ChipHeader, const char *FullFilePath)
       NumCrtChips, toU32(ChipHeader+0x04), toU16(ChipHeader+0x08), toU16(ChipHeader+0x0A), 
       toU16(ChipHeader+0x0C), toU16(ChipHeader+0x0E));
 
+   if (LoadedEasyFlashROM)
+   {
+      // Read-only EasyFlash extensions retain one 8 KiB CHIP per ROM half.
+      const uint16_t Bank = toU16(ChipHeader+0x0A);
+      const uint16_t Address = toU16(ChipHeader+0x0C);
+      const uint16_t Type = toU16(ChipHeader+0x08);
+      if (Bank >= 256 || toU16(ChipHeader+0x0E) != 8192 ||
+          toU32(ChipHeader+0x04) != CRT_CHIP_HDR_LEN+8192u ||
+          (Type != 0 && Type != 2) ||
+          (Address != 0x8000 && Address != 0xa000 && Address != 0xe000)) return false;
+      for (uint16_t Previous=0; Previous<NumCrtChips; Previous++)
+         if (CrtChips[Previous].BankNum == Bank &&
+             (CrtChips[Previous].LoadAddress == 0x8000) == (Address == 0x8000)) return false;
+   }
+
    CrtChips[NumCrtChips].BankNum = toU16(ChipHeader+0x0A);
    CrtChips[NumCrtChips].LoadAddress = toU16(ChipHeader+0x0C);
    CrtChips[NumCrtChips].ROMSize = toU16(ChipHeader+0x0E);
@@ -461,6 +498,7 @@ bool PathIsRoot()
 bool SetTypeFromCRT(StructMenuItem* MyMenuItem, uint8_t EXROM, uint8_t GAME)   
 {
    SendMsgPrintfln("%d Chip(s) found/loaded", NumCrtChips); 
+   if (!NumCrtChips) return false;
    MyMenuItem->Code_Image = CrtChips[0].ChipROM;
 
    //check configuration
 
@@ -179,7 +179,8 @@ StructHWID_IOH_Assoc HWID_IOH_Assoc[]=
 
 #define CRT_MAIN_HDR_LEN  0x40
 #define CRT_CHIP_HDR_LEN  0x10
-#define MAX_CRT_CHIPS     128
+#define MAX_CRT_CHIPS     512
+#define MAX_LEGACY_CRT_CHIPS 128
 
 #define SwapSeekAddrMask   0xef000000   //virtual address mask/marker for swap-out blocks, or-ed with file seek address (minimal build only)
 
@@ -192,6 +193,9 @@ struct StructCrtChip
    uint16_t BankNum;
 };
 
+bool EnsureCrtChipTable();
+void FreeCrtChips();
+
 #ifndef MinimumBuild
    //only needed in full build:
    struct StructExt_ItemType_Assoc
 
@@ -18,9 +18,18 @@
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 #define Printf_Swaps     Serial.printf  //Printf_dbg   //
+#ifdef VM_HOST_PROFILE
+// VMBoot validates a complete 16 KiB client and mirrors it across 64 banks.
+// Its ABI-reserved RAM2 arena cannot host the native CRT erased-page buffer.
 #define NumDecodeBanks   64
+#else
+#define NumDecodeBanks   256
+// ROM reads run in the PHI2 ISR: an erased half must live in RAM, never flash.
+DMAMEM static uint8_t EasyFlashErasedBank[8192];
+#endif
 uint8_t *BankDecode[NumDecodeBanks][2];
 uint8_t EZFlashRAM[256];
+uint8_t EasyFlashBankMask = 0x3f;
 #ifdef FeatVMHost
 // Defined by the extension image only. Stock builds compile none of this.
 uint8_t CurrentEasyFlashBank;
@@ -63,7 +72,7 @@ stcIOHandlers IOHndlr_EasyFlash =
 };
 
 #ifdef MinimumBuild
-void LoadBank(uint32_t SeekTo, uint8_t* ptrImage)
+static bool ReadBank(uint32_t SeekTo, uint8_t* ptrImage)
 {
    if(!myFile)
    {
@@ -81,51 +90,90 @@ void LoadBank(uint32_t SeekTo, uint8_t* ptrImage)
       if (!myFile) 
       {
          Printf_dbg("File Not Found");
-         return;
+         return false;
       }
    }
    //Printf_dbg("\n %lu mS Open ", millis()-Startms);
 
-   myFile.seek(SeekTo);
-   //One bulk read: SdFat moves whole sectors straight into the buffer instead of 8192 single-byte calls.
-   //   SdFat returns -1 on error (through File's size_t, hence the cast); fill any shortfall with
-   //   0xff, which is what the byte-wise read() returned past the end of the file.
-   int BytesRead = (int)myFile.read(ptrImage, 8192);
-   if (BytesRead < 0) BytesRead = 0;
-   if (BytesRead < 8192) memset(ptrImage + BytesRead, 0xff, 8192 - BytesRead);
-   //myFile.close();
-   //Printf_dbg("\n %lu mS Load ", millis()-Startms);
+   // Do not publish a stale or partial page after a failed seek/read.
+   return myFile.seek(SeekTo) && myFile.read(ptrImage, 8192) == 8192;
+}
+
+// Magic Desk 2 shares this reader and retains its erased-page fallback.
+void LoadBank(uint32_t SeekTo, uint8_t* ptrImage)
+{
+   if (!ReadBank(SeekTo, ptrImage)) memset(ptrImage, 0xff, 8192);
 }
+
+static void EasyFlashSwapFailed()
+{
+   LOROM_Image = HIROM_Image = NULL;
+   SetGameDeassert;
+   SetExROMDeassert;
+   doReset = true;
+   DMA_State = DMA_S_StartDisable;
+}
+uint8_t* ImageCheckAssign(uint8_t* BankRequested);
 #endif
 
 void InitHndlr_EasyFlash()
 {
 
-   //initialize bank decode pointers
-   for(uint8_t BankNum = 0; BankNum < NumDecodeBanks; BankNum++) {BankDecode[BankNum][0]=NULL;BankDecode[BankNum][1]=NULL;}
-   for(uint8_t ChipNum = 0; ChipNum < NumCrtChips; ChipNum++)
+   EasyFlashBankMask = 0x3f;
+#ifdef VM_HOST_PROFILE
+   uint8_t* ErasedBank = NULL; // native CRT initialization is unused by VMBoot
+#else
+   memset(EasyFlashErasedBank, 0xff, sizeof EasyFlashErasedBank);
+   uint8_t* ErasedBank = EasyFlashErasedBank;
+#endif
+   // Sparse native images read as erased flash, including an absent ROMH in bank 0.
+   for(uint16_t BankNum = 0; BankNum < NumDecodeBanks; BankNum++) {BankDecode[BankNum][0]=ErasedBank;BankDecode[BankNum][1]=ErasedBank;}
+   for(uint16_t ChipNum = 0; ChipNum < NumCrtChips; ChipNum++)
    {
       Printf_dbg("Bank# %02d,%d  chip# %03d  addr %08x\n", CrtChips[ChipNum].BankNum, (CrtChips[ChipNum].LoadAddress == 0x8000 ? 0 : 1), ChipNum, (uint32_t)CrtChips[ChipNum].ChipROM);
       if (CrtChips[ChipNum].BankNum < NumDecodeBanks)
-         BankDecode[CrtChips[ChipNum].BankNum][CrtChips[ChipNum].LoadAddress == 0x8000 ? 0 : 1] = CrtChips[ChipNum].ChipROM;
+      {
+         const uint16_t Bank = CrtChips[ChipNum].BankNum;
+         if (Bank >= 128) EasyFlashBankMask = 0xff;
+         else if (Bank >= 64 && EasyFlashBankMask != 0xff) EasyFlashBankMask = 0x7f;
+         BankDecode[Bank][CrtChips[ChipNum].LoadAddress == 0x8000 ? 0 : 1] = CrtChips[ChipNum].ChipROM;
+      }
       else Serial.printf("Unexp Bank# (%d) in chip %d\n", CrtChips[ChipNum].BankNum, ChipNum);
    }
 
    memset(EZFlashRAM, 0, 256);
 
 #ifdef MinimumBuild
    //initialize/invalidate swap buffer, pre-load first swappable chips
-   uint8_t ChipNum = 0;
+   uint16_t ChipNum = 0;
    for(uint8_t BuffNum = 0; BuffNum < Num8kSwapBuffers; BuffNum++) 
    {
       SwapBuffers[BuffNum].Offset=0; //default to zero/invalid
+      // Bank 0 must be resident before the C64 is released, even when CHIP
+      // packets are unordered and its halves were not loaded into RAM.
+      uint8_t* StartupHalf = BuffNum < 2 ? BankDecode[0][BuffNum] : NULL;
+      if (((uint32_t)StartupHalf & SwapSeekAddrMask) == SwapSeekAddrMask)
+      {
+         if (!ReadBank((uint32_t)StartupHalf & ~SwapSeekAddrMask, SwapBuffers[BuffNum].Image))
+         {
+            EasyFlashSwapFailed();
+            return;
+         }
+         SwapBuffers[BuffNum].Offset = (uint32_t)StartupHalf;
+         continue;
+      }
       //find next chip marked as swappable
       while (ChipNum < NumCrtChips)
       {
-         if(((uint32_t)CrtChips[ChipNum].ChipROM & SwapSeekAddrMask) == SwapSeekAddrMask)
+         if(((uint32_t)CrtChips[ChipNum].ChipROM & SwapSeekAddrMask) == SwapSeekAddrMask &&
+            CrtChips[ChipNum].BankNum != 0)
          {
             //pre-load and update
-            LoadBank((uint32_t)CrtChips[ChipNum].ChipROM & ~SwapSeekAddrMask, SwapBuffers[BuffNum].Image);
+            if (!ReadBank((uint32_t)CrtChips[ChipNum].ChipROM & ~SwapSeekAddrMask, SwapBuffers[BuffNum].Image))
+            {
+               EasyFlashSwapFailed();
+               return;
+            }
             SwapBuffers[BuffNum].Offset = (uint32_t)CrtChips[ChipNum].ChipROM;   
             Printf_Swaps("Pre%d: %08x\n", BuffNum, (uint32_t) SwapBuffers[BuffNum].Offset & ~SwapSeekAddrMask);
             ChipNum++;
@@ -137,8 +185,13 @@ void InitHndlr_EasyFlash()
 #endif
 
    //start with Bank 0:
+#ifdef MinimumBuild
+   LOROM_Image = ImageCheckAssign(BankDecode[0][0]);
+   HIROM_Image = ImageCheckAssign(BankDecode[0][1]);
+#else
    LOROM_Image = BankDecode[0][0];
    HIROM_Image = BankDecode[0][1];
+#endif
    //Printf_dbg("Jmp vect: $%02x%02x\n", HIROM_Image[0x1FFD], HIROM_Image[0x1FFC]);
    if(memcmp(HIROM_Image+0x1800, "eapi", 4)==0) Serial.printf("EAPI found\n");
    else Printf_dbg("EAPI *not* found: %d %d %d %d\n", HIROM_Image[0x1800], HIROM_Image[0x1801], HIROM_Image[0x1802], HIROM_Image[0x1803]);
@@ -182,7 +235,7 @@ void IO1Hndlr_EasyFlash(uint8_t Address, bool R_Wn)
       switch (Address)
       {
          case 0x00:   // Register $DE00 – EasyFlash Bank (write-only)
-            Data &= 0x3f;
+            Data &= EasyFlashBankMask;
 #ifdef FeatVMHost
             CurrentEasyFlashBank = Data;
 #endif
@@ -248,7 +301,12 @@ void PollingHndlr_EasyFlash()
          if(HIROM_Image && HIROM_Image == SwapBuffers[NextSwapBuffNum].Image)
             if(++NextSwapBuffNum==Num8kSwapBuffers) NextSwapBuffNum=0;
 
-         LoadBank((uint32_t)LOROM_Image & ~SwapSeekAddrMask, SwapBuffers[NextSwapBuffNum].Image);
+         SwapBuffers[NextSwapBuffNum].Offset = 0;
+         if (!ReadBank((uint32_t)LOROM_Image & ~SwapSeekAddrMask, SwapBuffers[NextSwapBuffNum].Image))
+         {
+            EasyFlashSwapFailed();
+            return;
+         }
          Printf_Swaps("L%02d: %08x  ", NextSwapBuffNum, (uint32_t)LOROM_Image & ~SwapSeekAddrMask);
          SwapBuffers[NextSwapBuffNum].Offset = (uint32_t)LOROM_Image;
          LOROM_Image = SwapBuffers[NextSwapBuffNum].Image;
@@ -261,7 +319,12 @@ void PollingHndlr_EasyFlash()
          if(LOROM_Image && LOROM_Image == SwapBuffers[NextSwapBuffNum].Image)
             if(++NextSwapBuffNum==Num8kSwapBuffers) NextSwapBuffNum=0;
 
-         LoadBank((uint32_t)HIROM_Image & ~SwapSeekAddrMask, SwapBuffers[NextSwapBuffNum].Image);
+         SwapBuffers[NextSwapBuffNum].Offset = 0;
+         if (!ReadBank((uint32_t)HIROM_Image & ~SwapSeekAddrMask, SwapBuffers[NextSwapBuffNum].Image))
+         {
+            EasyFlashSwapFailed();
+            return;
+         }
          Printf_Swaps("H%02d: %08x  ", NextSwapBuffNum, (uint32_t)HIROM_Image & ~SwapSeekAddrMask);
          SwapBuffers[NextSwapBuffNum].Offset = (uint32_t)HIROM_Image;
          HIROM_Image = SwapBuffers[NextSwapBuffNum].Image;
 
@@ -32,8 +32,8 @@ stcIOHandlers IOHndlr_MagicDesk =
   NULL,                  //called at the end of EVERY c64 cycle
 };
 
-extern StructCrtChip CrtChips[];
-extern uint8_t NumCrtChips;
+extern StructCrtChip *CrtChips;
+extern uint16_t NumCrtChips;
 
 uint8_t BankReg; 
 
 
@@ -147,8 +147,8 @@ extern bool DMAByte(uint8_t *Data);
 
 extern void FreeDriveDirMenu();
 extern uint8_t RAM_Image[];
-extern StructCrtChip CrtChips[]; // Removal breaks downstream code, so keep it here for now. 
-extern uint8_t NumCrtChips;        
+extern StructCrtChip *CrtChips; // Removal breaks downstream code, so keep it here for now.
+extern uint16_t NumCrtChips;
 extern StructMenuItem *DriveDirMenu;
 extern uint8_t *ptrRAM_ImageEnd;    // points to end of CRT-used RAM1 buffer