Thanks, that's some very interesting stuff! These boards are actually somewhat different, though it appears that the Demo Boy II is rev A while the Demo Vision is rev B, so it might still be that Demo Boy and Demo Vision systems of the same revision are the same.
The firmware dump that we have is from PRG rev B, so I'd be very interested in a dump of that Demo Boy II PRG rev A firmware. Would you be able to dump that? Given how little there is in the firmware, I'm not sure what could possibly have changed, so I'm excited to compare them. Also of interest for dumping is the U46 PAL on board boards, though I'm told that requires an adapter or specific programmer. I'm not sure yet what it controls, and I'm curious if it differs by board revision.
The Demo Boy top side image is unfortunately very difficult to make out, but it looks like that's a property of the board itself rather than an issue with the photo. Aside from that, I think these images are probably good enough, although if you can do higher resolution, it'd make things easier; the traces definitely blur together at times.
Looking over the Demo Vision board, which is much easier to read, it looks like the 8 KiB CPU RAM is hooked up to the CPU A11 and A12 lines, so I think this system actually does have a full 8 KiB from $0000-1FFF. All 6 DIP switches go to a hex inverter, and I suspect that inverter's output enable is controlled by joypad 1 /OE. The inverter outputs look like they're hooked up to CPU D0-D5, so reading $4016 should give all 6 switches. It's hard to tell exactly in the photo, but I think switches 1-6 connect to D0-D5, respectively. The firmware doesn't use D3-D5, so those switches should have no effect. I guess I'm not 100% sure how the switches read, but it looks like the hex inverter's inputs are pulled up by R6, so when the switches are open, they should read to the CPU as 0, and according to the datasheet, the switch in the up position is open. The image here, I think, shows switches 1 and 3 down, which would result in unlimited time, which makes sense. (Similarly, Chris Covell's had 1 and 2 down, which is an 8 minute timer, and he mentioned his system would 'randomly' reset.)
I'll continue looking over these to see what I can figure out, though I'm more of a software than hardware guy. If anyone more skilled than I can get insights into the unknowns I posted in the first post, please do let us know.
Edit: I've updated the
Demo Vision page with these new findings.