I'll bite.
I've been in a disassemble crud mood.
It's Mega Man. I've poked about one game's RNG, I guess I may as well look at this Energy Balancer.
For now, until I start crunching on code, my wild guess is that the game gets a count of weapons, then starts iterating through them until there are no more weapons. It would assume there's at least one weapon, so it would loop once, do a decrement, then see if it hit zero. If it was already zero, it would decrement the zero to 255, and find out it's not zero after all. Presumably, unintended memory is used after that. But that's just a wild guess.
EDIT:
;Location 1D:949C
LDA $0699 ;Weapon selection?
STA $05C8,X ;Target weapon
BNE _94C9 ;If it isn't zero, then escape function
LDA $0696 ;Energy Balancer
BEQ _94C9
LDA #$FF
STA $0000 ;Set temp with 255 -- Lowest ammo we found so far
LDY #$09 ;Set up loop for weapons
_94AF LDA $0688,Y ;Weapon
CMP #$80
BEQ _94C1
CLC ;If we're here, we have the weapon.
ADC #$01 ;Take weapon's ammo + 1. For some reason.
CMP $0000 ;See if this weapon's the lowest one so far.
BCS _94C1
STA $0000 ;If so, this is our new ammo count
STY $0001 ;And this is our new target weapon
_94C1 DEY ;Continue weapon loop
BNE _94AF
LDA $0001 ;Weapon with lowest ammo
STA $05C8,X ;Target weapon
_94C9 RTS
I did a breakpoint check for 0696, which apparently is the Energy Balancer. The above function is called from location 1D:9486, and I didn't look through there as yet. I also haven't analyzed what X is coming into this function.
Anyway, I can already tell there's a problem with detection here. Address $0001 is used to identify the weapon, but if we have none of the eight weapons or Beat, then $0001 was never updated with a weapon ID. Therefore, the function returns a stale value, whatever the last thing the game was doing with that address. And that will be tricky to analyze.
And most likely, stuff after 0688 appears to be at great risk of being modified by this glitch. Anyway, that's what I found so far.
My wild guess wasn't on point.
