I am doing a conversion of SMB1 to MMC3, in order to expand available space for levels using ROM bank switching.

I am using 256K of PRG-ROM, for 32 ($00-$1f) pages.

I have re-mapped the reset vector to an area within the level data ($9fd8 to be exact). This level data isn't used until later in the game (4-3 and 6-3, again to be exact), so this doesn't pose a problem for now. I have this proc mirrored in the same spot in pages $00 and $1e (since some emulators like to load page $00 to $8000 on startup, and some like to load page $1e both there and $c000, and also because page $1e will be going there later (read on). This proc sets the page for $a000 to $1c, and the page for $c000 to $1d (using function #'s $46 and $47 to $8000), then jmps to the old main entry point of $8000. At this point, the pages are set up in memory as follows:

$8000 = page $1e = page $00 of original smb rom (+bankswitching patch)
$a000 = page $1c = page $01 of original smb rom
$c000 = page $1d = page $02 of original smb rom
$f000 = page $1f = page $03 of original smb rom (+vector patches)

The only other code I've modified is the IRQ vector, which I've set to point to a legit rti instruction, since it points to garbage in the original ROM.

The LoopyNES debugger 'S' command verifies this is working correctly. The game loads up fine, and plays fine on FCE Ultra, NESTen, and Nesticle. It loads fine on LoopyNES, but glitches when the first sprite beyond Mario (eg. the first goomba, or if I remove him, the mushroom in the ? block) begins moving, no matter whether it is in the startup demo loop, or an actual live game. I end up in my IRQ handler, with an invalid return address (S=$FE). What in Mercury's MHz is going on here? Anyone have a clue? I'd appreciate the help.

Thanks.