Well, at the very least, in both modes, a full address is being correctly expressed in the proper timing according to the address lines on the chips, and those values are inverted, like you said, modem7. (i.e. FE instead of 01 and FC instead of 03)
I will try to correlate it with the data-ins...