That more or less confirms that you have some kind of logic issue.
Looking through the GAL logic, $f99d0000 should be the first address in the onboard RAM. A31-A24 identify the slot (9) in IO space, A23-A18 are not decoded - any value is fine, so many different addresses will address the same regions of ROM/RAM, and A16 must be set (1). A17 is the critical bit, so if it is 1, ROM OE is asserted. ($f99f0000). If A17 is 0, either RAM OE is asserted or RAM WE depending on R/W signal.
We know ROM access works, because without that the card wouldn't be detected at all. And at least some of the buffers are behaving sanely, because that'd cause the ROM access to have issues: it would fail checksum, and the card would not be further initialized.
If I had this card in hand, my next step would be to poke bytes and words at the aforementioned address using MacsBug. Essentially perform your own memory test - write a byte, see if you get it back, and verify that you can read/write words also. Depending on what you see from that it may give a pointer as to where the issue lays.
Given that the card works sometimes and sometimes not, the simple explanation is a dodgy trace or solder joint rather than a failed IC. May be worth warming the card up or chilling it down before use and seeing if behavior changes. Maybe post some high res well-lit pictures of the card front and back, too? I would recommend looking very closely at U16 and U15.