Hi Siggi,
I think I've sorted out things a little bit:
First I've tried to disable ZX81's internal memory completely and only use the expansion board's memory to simplify things. Then the ZX81 came up with this pic after switched on:
After some investigations and a look to the ZX81 schematics I've remembered why I've done the trick with the diode between /RFSH and /ROMCS_INT (which is the chip select of the internal ZX81 ROM): The addresses for the font lookup (while /RFSH is low) will only reach the internal ROM, since it's address bus is loosely connected to the CPU bus via R18-R26. So the ULA is able to apply the fake addresses (only) to the internal ROM.
Since I was not very happy with the diode stuff and the potential risk of activating two data bus line drivers at the same time I've tried to generate all the needed signals, which allows to enable the internal ROM at the critical points:
Now the text mode is working again and even the TESTBILD.P from Bodo Wenzel is working (which already was with the original logic):
The open question is: why is HRDEMO3.P not working (should it)?
I'm not 100% sure about the required memory layout. Currently it looks like that:
0x0000 - 0x3FFF: lower 16K of ROM
0x4000 - 0x7FFF: lower 16K of RAM
0x8000 - 0xBFFF: upper 16K of ROM
0xc000 - 0xFFFF: upper 16K of RAM
Do you have any idea or suggestion?
Thank You & Kind Regards
Sascha