I've disassembled the game to find out HOW the bug works, so I'll be editing this post shortly...
How the bug works:
It's stuck in a loop somewhere. It's incrementing a variable (let's call it Y), then checking if it is equal to the max value. Unfortunately, the max value is ZERO, and it's comparing after incrementing. So it's stuck chugging away in the loop way beyond the loop's max value. In normal circumstances, Y will never be greater than 3, but this is a crazy wacko out of bounds loop.
RAM involved:
address 93+ (Contained 55 49 49 49 when I looked, probably 4 bytes large)
address 68+ (Party member numbers, 01 02 03 03 when I looked)
The bug algorithm:
Y=Y+1
If mem[93+Y]&1F == 1 //this is the swamp tile check, fortune telling room has swamp as tile #1
X=mem[68+Y] //normally, X is between 0 and 3, but in this case it's way off!
Deal Swamp Damage to party member #X
Repeat until Y overflows 255 back to zero
Swamp Damage:
hp=mem[71C+X*2] //16 bit value
hp=hp-2
If hp went below zero, set it to zero
mem[71C+X*2]=hp
What happens is that this gets called with some invalid X that came from nowhere, so it messes up your stats. The exact effects are only predictable if you look at the entire Zero Page memory contents.
For example, I took a memory dump, and ran a program to calculate X*2 for each Y where it would deal swamp damage:
.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
.. .. 0E F4 .. .. .. .. .. .. .. .. .. 92 .. ..
.. .. .. AC .. 06 .. .. .. .. .. .. .. .. .. ..
.. .. .. .. .. .. .. .. .. .. 00 .. .. .. .. ..
.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
.. .. .. .. .. .. 16 .. .. .. .. .. .. 30 .. ..
.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
.. .. .. .. .. .. .. .. .. .. .. .. 12 .. .. ..
.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
.. .. 00 .. .. .. 0C .. .. .. .. .. .. .. .. ..
.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
.. .. 00 .. .. 68 .. .. .. .. 4E .. .. .. 00 ..
00 .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
.. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
Depending on the value of X*2, it will decrease one of these by 2:
Current HP 0
Current MP 8
Maximum HP 10
Maximum MP 18
Status 20
Experience 29
Name 40
Items 60
Wizard's Battle Magic 80
Wizard's Field Magic 83
Pilgrim's Battle Magic 84
Pilgrim's Field Magic 87
The 68 on the table is key, that modifies the second party member's first item. That value isn't always going to appear on the table, I was just really lucky to get it.
First, let a Killer Bee paralyze one character in the party, then kill two other party members.
Return to Allihan. Use luck manipulation with each step to ensure that the paralysis does not wear off.
Drop off the non-paralyzed living guy at Luisa's Place. Then you can drop off the paralzyed party member there too!
Normally, the game checks to see if removing a party member would cause your party consist entirely of dead people, and displays a funny message if you try it. However, there is a BUG in the game that lets you remove the character if your entire party is either paralyzed or dead. It's also a bug that it let a paralyzed character lead the party in the first place.
Yep, now you have a dead party. Now whenever you walk around in any area which contains a Poison Swamp tile loaded into the tileset, you get the magical stats corrupting bug. It doesn't matter whether the swamp tile actually appears on the map or not, it just has to be loaded into the map's tileset.
One such place that loads the swamp tile is the Prison area in Allihan castle.
For each step you take, you trigger the stats corrupting bug.
And that's basically the new stuff.
-----------------------------------------
But wait... there's more.
Sometimes it will add characters into the party. Here it added in a null character with zeroes for all stats, including a lovely inventory.
You can revive the character, then give it a Wing of the Wyvern.
The glitch character has an empty list of return destinations, and using the wing takes you to the black area in Alefgard. It's not known if this is manipulable.