$FEA0 area details are incorrect

[aaaaaa123456789]

The memory map section says:

$FEA0 – $FEFF: Unmapped (pulled high, reads $FF)

This is not correct; this area is mapped to something. That "something" tends to be its own block of memory, with some very weird timing and aliasing rules; there's no guarantee that you'll read $FF from it (and in fact, you often won't), and the area might even be R/W.

[endrift]

I've conferred with @LIJI32 a bit on this and corrected it some, but it needs more detail.

[LIJI32]

In short: This area is only readable while OAM is readable (Otherwise it reads $FFs). When it is readable, the value it reads depends on the model and revision:

• DMG, SGB, MGB, SGB2: Reads $00s
• CGB-E, AGB, AGS, GBP: Reads a static pattern: $AA repeated 16 times, $BB repeated 16 times, ... $FF repeated 16 times.
• CGB-0 to CGB-D: This area is R/W, but there's some masking going on with the address when reading and writing, and the mask varies between revisions. Writability timing is identical to OAM. In CGB-D, bits $F0 are static/ignored. In the other revisions, bits 0x18 are ignored.