From: Han on
It is my understanding that the later half of ROM bank 0 is devoted
to:

1. indirect bank 0 calls via the #11111
2. addresses executed by indirection
3. ML jumps (through GOVLNG)
4. internal RPL objects and misc routines
5. flash pointers called via #11111 handler
6. more regular RPL objects
7. then more indirect calls in the address area near #35000 and above

Besides the #11111 types, does anyone know the exact boundaries of
these categories?

Thanks in advance.
-- Han