The Apple eMate 300 boot ROM is a huge jerk. The first instruction it runs is branch to 0x01A00004, which is well outside the 8-meg space it occupies. There's got to be something stupidly simple that I'm missing here, but I'll be darned if I know what it is.
-
I know the original Newtons mirrored the 4MB (or 8MB for the MP130s) ROM across 16MB of address space (starting at 0x00000000). RAM is similar but I don’t recall the details
Wouldn't surprise me if the eMate 300 has similar mirroring for its 8MB ROM - though 1A00004 is about A00004 beyond the 16MB limit, and there's no practical reason it'd be bouncing to RAM on the first instruction of a cold boot. This hardware is cursed.