I'm really close to the end, but I have to face the elixir glitch now.
This glitch allows you to insta-kill the last two bosses, by glitching the menu with the help of the GreenDream (auto-revive once). Sometimes, when the entire party is wiped out and the character with the GreenDream is revived, the command menu is glitched and it allows you to launch an elixir at the enemy and kill him (probably an overflow glitch).
However, it is not known what are the conditions to trigger this glitch. Inichi, who discovered the glitch, only says it triggers when "two RNG conditions are met". It is sensible to the battle RNG, the equipment and even the timing of commands during the fight. I'm trying to disassemble the game to find how it works, but I have very little experience of this so it's really tedious.
So if some people would like to help, I'm providing savestates before a fight with the glitch. You can see if the glitch is working when the character with the GreenDream (here Crono) lies down for a few frames after being revived. I think this glitch has to do with the game considering it's a gameover and starting appropriate routines, before it realizes that Crono has to be revived. That's why I'm also providing a gameover outcome savestate.
Glitch happening:
User movie #13715645762272053
Glitch not happening due to changing the battle RNG:
User movie #13715684510794266
Glitch not happening due to removing Ayla's armor (!):
User movie #13715712519445572
Gameover by removing Crono's GreenDream:
User movie #13715735465747366
I've identified a few functions:
0xc141be - 0xc14211: Check for negative HP after damage, and set a death flag. This is a different routine that the one that computes the remaining HP after damage and modifies the HP values accordingly.
0xc1414e - 0xc1416a: If death flag of char 1 is set, clear it and call 0xc11c4a
0xc1416d - 0xc1418b: same for char 2
0xc1418e - 0xc141ac: same for char 3
0xc11c4a is called a fourth time when Crono is revived.
I didn't go that much further :(
