We need to look at the video address generation circuit. Most likely the CPU put the data values, that correspond to the characters, into the correct places in the video memory map, or likely it would not be so orderly, but somehow the addresses which read them out of the video memory and clock them out of the shift register, have got flipped and the map (addresses) are being scanned out out in reverse, something like an up/down capable counter running in reverse........I'll look at the circuit. (This must be one of the more interesting faults ever reported in a PET and beats the pants off the recent "Ghost Writer" fault I had in a PET board which was due to a defective PIA)