What you describe is certainely possible, however I'm not sure it's possible with the power pak (I'm not sure how it's wired anyway).
What you need is to have tri-state buffers between the PPU adress AND control bus and the CHR-RAM. Then the mapper could force the PPU to become tri-state (trough the tristate buffer), and highhack all dummy reads to take advantage of this time to write to CHRRAM.
However, in VBlank, the PPU line is not tristate, /RD and /WR are normally high. $2006 contol more or less directly the adress but, and whenever the CPU reads or write $2007, /RD and /WR respectively will imediately go low (exept if the adress is in $3f00-$3fff range). The data bus should always be high-Z exept when writing.
So if you're sure the PPU is only reading, you could highhack the /WR line to low (with a multiplexer or something), highhack the adress bus, and write your stuff. Having part of the adress controlled with $2006 is possible during VBlank, I doubt it's possible during HBlank.
Question about bank switching CHR data from PRG RAM
Moderator: Moderators