the attroff1 byte does start at $C0, and is reset to $C0 once it reaches $FF later on in the NMI. Upon entering the attribute section, the address at $10 and $11 is not pointing directly to the attribute table, but directly at the beginning of the nametable data for that map. I don't know how to get it to point directly at the attribute table. That is why I have to do the freakish offset stuff. Point to the beginning of nametable, then offset by $3C0.
I made a couple changes, I had forgotten to take care of the high byte of the offset, and I tried to account for y rolling over but I don't think indexed addressing sets the zero bit:
;--DRAW 2 BYTES OF ATTRIBUTE TABLE NOW--;
;If using $28, attribute table starts at $2BC0
;If using $20, starts at $23C0
lda whichnam ;will be either $28 or $20
beq attr2 ;if its not $28, it must be $20, so continue from here
sta $2006 ;high byte of first attribute table
lda attroff1 ;low byte offset will go from $C0 to $FF
sta $2006 ;$2006 now knows where to copy nametable data TO.
;Address of beginning of nametable location is already in $0010 and $0011 from code before
adc #3 ;high byte offset is $3 because offset is $3C0
ldy attroff1 ;this starts from $C0 and goes to $FF
bne temp9 ;if $10 + y rolls over to 0, add one to the high
lda $11 ;byte offset but I don't think this works with indirect
;only draw 2 bytes of the next attr table at a time
sty attroff1 ;y increments 2 bytes and gets stored for next time
jmp endattr ;SKIP over the rest of the attribute code
attr2: ;we jumped to here if it was nametable $28xx
lda attroff1 ;can use same variable as before because it still goes from $C0 to $FF
sta $2006 ;and it was reset to $C0 after the last nametable flipped.
sty attroff1 ;we are done updating the attribute table a whole 2 bytes, wow!
;--END OF ATTRIBUTE TABLE UPDATING--;