Thank you all! Very fun stuff.
Interestingly, the early Classic II that I bought has EPROMs with stickers for the Apple part numbers instead of mask ROMs. Not that it would disprove your mask ROM theory, but I found it interesting nonetheless.
I still think it was a mistake. It wasn't assembled that way -- the ROM is accidentally jumping into the middle of a valid instruction. Here is what the intended code looks like, directly after a jump table filled with branch instructions:
Code:
movea.l $cec.w, A1 2278 0CEC
bclr #$4, ($1800,A1) 08A9 0004 1800
move.b #$90, ($1c00,A1) 137C 0090 1C00
What this is doing is loading the address of VIA2 into A1, then clearing a bit in one of its registers and writing a value to another register, for enabling sound interrupts.
What really happens though is, because we end up jumping past the bounds of the table of branch instructions, the program counter ends up pointing at the $0CEC, which is smack dab in the middle of the movea.l instruction. The same bytes end up being interpreted like this instead (MacsBug interprets this invalid CAS instruction slightly differently, this disassembly is from MAME):
Code:
cas.w D1, D0, ($4,A4) 0CEC 08A9 0004
move.b D0, D4 1800
move.b #$90, ($1c00,A1) 137C 0090 1C00
So A1 doesn't get initialized to the correct value, but we end up using it as an offset anyway with that final move.b #$90 instruction. The intended code for the Classic II, as seen in the IIvx ROM where they finally increased the size of the jump table, does nothing at all, so we're not really missing out on any vital initialization when it does this.
Apple would have easily found this bug during development of the Classic II ROM if not for the pesky 68030 hiding it from them by setting A1 to an address that doesn't crash on that final move.b instruction.