@@ -422,6 +422,10 @@ const uint8_t OutputPins[] = {
 #define Def_nS_DMADataHoldNTSC128  395
 //Other critical Timing
 #define Def_Cyc_KernProp    35  // Propagation delay for Kernal replace to sample ROMH to determine if HIRAM is asserted
+#define Def_nS_KSenseSample 250 // Kernal replace DMA HIRAM sense (C128): when ROMH is read, from the nS_DMASetup re-latch of the
+                                //   DMA read (like nS_DMADataSetup), about 44nS before Phi2 rises on an NTSC C128.
+                                //   10/28/26 flat NTSC C128 (Teensy cycle counter, same time base): ROMH seen low at 98-136nS
+                                //   over 180 senses, 98-116nS in 174.  Must stay below nS_DMADataSetup.
       //C64 long bd/PAL: 10 fails (occasional misdetect of ram on rom cycle) 11 passes
       //C64c/PAL: 19 fails (occasional misdetect of ram on rom cycle) 20 passes
       //was set to 21, but testing on another C64c NTSC (short) was marginal after warmup.
@@ -445,6 +449,7 @@ uint32_t nS_DMASetup  = Def_nS_DMASetupPAL;
 uint32_t nS_DMADataSetup = Def_nS_DMADataSetupPAL;
 uint32_t nS_DMADataHold  = Def_nS_DMADataHoldPAL;
 uint32_t Cyc_KernProp = Def_Cyc_KernProp;
+uint32_t nS_KSenseSample = Def_nS_KSenseSample;
 
 __attribute__((always_inline)) inline void DataPortWriteWait(uint8_t Data)
 {  // for "normal" (non-VIC) C64 read cycles only
 
@@ -58,16 +58,176 @@ enum enumHIRAM_States
 
 extern volatile uint8_t doReset;
 
+//HIRAM sense: how KernalCheck finds out, after a write to $00/$01, whether the KERNAL is banked in.
+//  (The 6510 doesn't put the value of a $00/$01 write on the external data bus, so it can't be tracked from the writes.)
+//  Skoe: on the first $E000+ read, drive A14 low with /EXROM+/GAME asserted (16K mode) and look at ROMH.
+//     This needs the PLA to see the address the TR drives over the CPU's.  On a C128 in C64 mode it doesn't: the
+//     expansion port's address lines come through a transceiver that drives towards the port outside DMA, so ROMH never
+//     answers, every sense reads "RAM", and the replacement image is never served.
+//  DMA: right after the write, hold the CPU with /DMA for one cycle and, as bus master, read $A000 with /EXROM+/GAME
+//     asserted: the PLA selects ROMH there only with HIRAM set.  The cycle after a store to $00/$01 is always the next
+//     opcode fetch, a read, so the CPU halts on it.  Costs the CPU one cycle per write to $00/$01 (more when the VIC
+//     holds the bus).  Used on a C128.
+enum enumHIRAMSenseModes
+{
+   KSense_Skoe = 0,
+   KSense_DMA  = 2,
+   KSense_Auto = 9,  //DMA on a C128 (the menu's machine report), Skoe otherwise
+};
+uint32_t KSenseMode = KSense_Auto;  //serial tx# (Dbg_SerTimChg)
+uint8_t  KSenseEff  = KSense_Skoe;  //the method in effect
+
+FLASHMEM void KSenseApplyMode()
+{
+#ifdef Fab04_FullDMACapable
+   KSenseEff = (KSenseMode == KSense_Auto) ? ((IO1[wRegVid_TOD_Clks] & rvtcC128) ? KSense_DMA : KSense_Skoe) :
+               (KSenseMode == KSense_DMA) ? KSense_DMA : KSense_Skoe;
+#else
+   KSenseEff = KSense_Skoe;
+#endif
+   if (KSenseEff == KSense_DMA) Serial.println(PSTR("Kernal HIRAM sense: DMA"));
+   else Serial.println(PSTR("Kernal HIRAM sense: Skoe"));
+}
+
+#ifdef Fab04_FullDMACapable
+enum enumKDS_States
+{
+   KDS_Idle,
+   KDS_Skip,         //the sense cycle's rising-edge interrupt arrives late (in Phi2 low): drop it.  It always arrives: the
+                     //  Teensy core clears the GPIO interrupt flag before it calls isrPHI2, so the edge during the sense sets it again.
+   KDS_WaitBus,      //DMA asserted, BA was low: try the sense read on the next cycle
+   KDS_AfterRead01,  //a write to $00/$01 right after a read of $00/$01: the first of a read-modify-write's two
+                     //  writes, or a store after an indexed dummy read.  The next cycle tells which.
+};
+volatile uint8_t KDS_State = KDS_Idle;
+uint8_t  KDS_Guess = HIRAM_State_ROM;  //last verdict, for a KERNAL read no sense could precede
+uint32_t KDS_Read01Cyc = 0;            //ARM_DWT_CYCCNT of the last CPU read of $00/$01
+bool     KDS_Read01Valid = false;
+
+//Phi2 low (StartCycCnt = falling), /DMA asserted: one DMA read of $A000 with /GAME+/EXROM, address timing as DMAByte's.
+//false: bus not available (badline, sprite fetch), try again on the next cycle
+FASTRUN bool KDS_SenseCycle()
+{
+   WaitUntil_nS_fine(nS_DMABAWait);
+   if (!GP9_BA(ReadGPIO9)) return false;
+
+   uint32_t RegAddrBits = (0xA000 << 16);
+   CORE_PIN19_PORTSET = RegAddrBits; //set address port value to be ready for output drive
+   CORE_PIN19_PORTCLEAR = ~RegAddrBits & GP6_AddrMask;
+   WaitUntil_nS(nS_DMASetup);  //just ahead of Phi2 rising
+   StartCycCnt = ARM_DWT_CYCCNT;
+   SetAddrBufsOut;
+   SetAddrPortDirOut;
+   SetExROMAssert;
+   SetGameAssert;
+
+   WaitUntil_nS_fine(nS_KSenseSample);
+   HIRAM_State = KDS_Guess = (GP9_ROMH(ReadGPIO9)==0 ? HIRAM_State_ROM : HIRAM_State_RAM);
+
+   WaitUntil_nS_fine(nS_DMADataSetup); //keep the address valid as long as a DMA read does
+   SetGameDeassert;
+   SetExROMDeassert;
+   SetAddrPortDirIn;
+   SetAddrBufsIn;
+   return true;
+}
+
+//Phi2 low, /DMA asserted, StartCycCnt = falling
+FASTRUN void KDS_Run()
+{
+   if (!KDS_SenseCycle())
+   {
+      KDS_State = KDS_WaitBus;
+      return;
+   }
+   while (GP6_Phi2(ReadGPIO6)); //Phi2 falling after the sense cycle
+   SetDMADeassert;              //release in Phi2 low, as isrPHI2's DMA_S_StartDisable does
+   KDS_State = KDS_Skip;
+}
+
+//Phi2 high of the CPU's write to $00/$01
+FASTRUN void KDS_Begin()
+{
+   if (DMA_State != DMA_S_DisableReady)
+   {  //another DMA user (REU, remote memory access) owns the line
+      HIRAM_State = KDS_Guess;
+      return;
+   }
+   while (GP6_Phi2(ReadGPIO6)); //Phi2 falling
+   StartCycCnt = ARM_DWT_CYCCNT;
+   WaitUntil_nS(nS_DMAAssert);
+   SetDMAAssert;
+   KDS_Run();
+}
+
+//The DMA sense's work for a cycle off the common path: a sense pending, or a $00/$01 access.
+//true ends the cycle: nothing else may answer it
+FASTRUN bool KDS_Slow(uint16_t Address, bool R_Wn)
+{
+   switch (KDS_State)
+   {
+      case KDS_Skip:
+         KDS_State = KDS_Idle;
+         return true;
+      case KDS_WaitBus:
+         while (!GP6_Phi2(ReadGPIO6)); //a late call (in Phi2 low) waits for the next cycle
+         while (GP6_Phi2(ReadGPIO6));
+         StartCycCnt = ARM_DWT_CYCCNT;
+         KDS_Run();
+         return true;
+   }
+   if ((Address & 0xfffe) == 0)
+   {
+      if (R_Wn)
+      {
+         KDS_Read01Cyc = ARM_DWT_CYCCNT;
+         KDS_Read01Valid = true;
+      }
+      else
+      {  //write to $00/$01
+         HIRAM_State = HIRAM_State_Unknown;
+         bool AfterRead = KDS_Read01Valid && (ARM_DWT_CYCCNT - KDS_Read01Cyc) < nSToCyc(1500); //the previous cycle
+         KDS_Read01Valid = false;
+         if (AfterRead && KDS_State != KDS_AfterRead01)
+         {
+            KDS_State = KDS_AfterRead01;
+            return true;
+         }
+         KDS_State = KDS_Idle;
+         KDS_Begin();
+         return true;
+      }
+   }
+   if (KDS_State == KDS_AfterRead01) KDS_State = KDS_Idle; //it was a store after a dummy read: this read is served on KDS_Guess
+   return false;
+}
+#endif
+
 //______________________________________________________________________________________________
 
 FASTRUN bool KernalCheck(uint16_t Address, bool R_Wn)
 {
+#ifdef Fab04_FullDMACapable
+   if (KSenseEff == KSense_DMA)
+   {  //this runs ahead of every IO1/IO2 answer, so the common cycle costs only these tests: work added here answers IO late
+      if ((KDS_State != KDS_Idle || (Address & 0xfffe) == 0) && KDS_Slow(Address, R_Wn)) return true;
+   }
+   else
+#endif
    //monitor port $0001 for changes
    if (!R_Wn && (Address & 0xfffe) == 0) HIRAM_State = HIRAM_State_Unknown;  //write to addr 0 or 1 causes re-evaluation of HIRAM
 
    if (!R_Wn || (Address & 0xe000) != 0xe000 || !GP9_BA(ReadGPIO9)) return false;  //continue with cycle processing
 
    // CPU read access from address $E000..$FFFF
+#ifdef Fab04_FullDMACapable
+   if (HIRAM_State == HIRAM_State_Unknown && KSenseEff == KSense_DMA) HIRAM_State = KDS_Guess; //no sense could precede this read
+#endif
+#ifndef KERNAL_MONITOR_ONLY
+   //HIRAM known to be RAM (no write to $00/$01 since it was sensed): the C64's own RAM answers, so leave /GAME and the
+   //data bus alone.  Asserting /GAME (Ultimax) here takes the read away from the RAM.
+   if (HIRAM_State == HIRAM_State_RAM) return true;
+#endif
 
    //prepare modified Address for Skoe HIRAM check (if needed)
    uint32_t RegAddrBits = ((Address & 0xbfff) << 16); //drive A14 low
@@ -206,6 +366,12 @@ FLASHMEM void InitHndlr_KERNALReplace_PreStart() //not called automatically via
    //Serial.printf("Read %lu Bytes in %lumS\n", CharNum, millis()-StartmS);
    Serial.printf("Read %lu Bytes\nKernal replace Enabled\n", CharNum);
    LoadFile.close();
+   KSenseApplyMode();
+#ifdef Fab04_FullDMACapable
+   KDS_State = KDS_Idle;
+   KDS_Read01Valid = false;
+   KDS_Guess = HIRAM_State_ROM;
+#endif
    delay(250);
 
    //hook kernal checks: runs before BASIC init, well before any PRG-load handshake (see
@@ -229,6 +395,10 @@ FLASHMEM void InitHndlr_KernalReplace()
    //hooked there, KernalCheck reads an unloaded KernalBin and drives GAME/EXROM over the cart's own.
    if (fBusSnoop != &HandshakeSnoop || KernalBin == NULL) return;
    HIRAM_State = HIRAM_State_Unknown;
+#ifdef Fab04_FullDMACapable
+   KDS_State = KDS_Idle;  //KernalCheck is unhooked during the handshake: no sense can be in flight
+   KDS_Read01Valid = false;
+#endif
    PendingfBusSnoop = &KernalCheck; //not fBusSnoop directly -- may still be mid PRG-load handshake, see HandshakeSnoop
 #endif
 }
 
@@ -513,6 +513,14 @@ FLASHMEM void ServiceSerial(Stream *ThisCmdChannel)
             case 'k': //Cyc_KernProp change
                GetDigits(2, &Cyc_KernProp);
                break;
+         #ifdef Fab04_KernalReplace
+            case 'x': //Kernal replace HIRAM sense: tx0 Skoe, tx2 DMA, tx9 auto (DMA on a C128)
+            {  extern uint32_t KSenseMode; extern void KSenseApplyMode(); GetDigits(1, &KSenseMode); KSenseApplyMode(); }
+               break;
+            case 'n': //Kernal replace DMA HIRAM sense: ROMH sample point
+               GetDigits(3, &nS_KSenseSample);
+               break;
+         #endif
             case 'd': //Set Defaults
             {  //match what detection would have set, or a sweep resumes from the wrong standard's values
                SetVideoStdTiming(); //MaxAdj and the DMA setup/hold set
@@ -525,6 +533,7 @@ FLASHMEM void ServiceSerial(Stream *ThisCmdChannel)
                nS_DMAAssert = Def_nS_DMAAssert;
                nS_DMABAWait = Def_nS_DMABAWait;
                Cyc_KernProp = Def_Cyc_KernProp;
+               nS_KSenseSample = Def_nS_KSenseSample;
                CmdChannel->printf("Defaults set (%s %s)\n", (IO1[wRegVid_TOD_Clks] & rvtcNTSC) ? "NTSC" : "PAL",
                   (IO1[wRegVid_TOD_Clks] & rvtcC128) ? "C128" : "C64");
                break;
@@ -547,6 +556,11 @@ FLASHMEM void ServiceSerial(Stream *ThisCmdChannel)
          CmdChannel->printf("\t nS_DMADataHold  %03d (tw###)\n", nS_DMADataHold);
          CmdChannel->printf("\t nS_DMADataSetup %03d (ty###)\n", nS_DMADataSetup);
          CmdChannel->printf("\t Cyc_KernProp  %02d (tk##)\n", Cyc_KernProp);
+      #ifdef Fab04_KernalReplace
+         { extern uint32_t KSenseMode; extern uint8_t KSenseEff;
+           CmdChannel->printf("\t KSenseMode    %lu, in effect %u (tx#: 0 Skoe, 2 DMA, 9 auto)\n", KSenseMode, KSenseEff); }
+         CmdChannel->printf("\t nS_KSenseSample %03lu (tn###)\n", nS_KSenseSample);
+      #endif
 
          CmdChannel->printf("\tSet Defaults      (td)\n");
          CmdChannel->printf("\tList current vals (t)\n-----\n");
 
@@ -16,6 +16,7 @@ All times in nS, from the `Def_nS_*` constants in [Common_Defs.h](../../Source/T
 | nS_DMASetup | Phi2 fall | 440 | 430 | 445 | Drive R/W and address, just before Phi2 rises |
 | nS_DMADataSetup | Re-latch at setup | 390 | 390 | 375 | Latch the data bus on a DMA read |
 | nS_DMADataHold | Re-latch at setup | 430 | 410 | 395 | Release the data bus on a DMA write |
+| nS_KSenseSample | Re-latch at setup | 250 | 250 | 250 | Kernal Replace HIRAM sense (C128): sample ROMH in the stolen cycle |
 | Phi2 period (nominal) | | 1015 | 978 | 978 | Reference |
 
 Derived positions, from Phi2 fall in the same cycle: