DPLC overlap bug

Previously, I talked about the buggy behavior which happens when you use Hyper Sonic's double jump ability to trigger Carnival Night Zone's bumpers while Tails is standing on top of a barrel. As with other contrived interactions of the sort, this was brought to my attention by GoldS' glitches and oversights series. In this video, GoldS goes on to point out that eventually, a bit of Tails' head goes missing in the confusion.

Each time their mapping frame changes, the player objects issue a DPLC request to DMA new tiles to a predetermined location in VRAM. Sonic and Knuckles' graphics are loaded to address $D000, and Tails' are loaded to address $D400. (Tails' tails are in turn loaded to address $D600 directly following Tails' graphics.)

As a consequence of this hardwired layout, none of Sonic's sprites should ever use more than 32 tiles: if they did, then part of Sonic's graphics would spill over into Tails' address space, resulting in a conflict.

Unfortunately, a couple of Super Sonic's sprites do cross over this limit, each of them using 33 tiles. In the above glitch scenario, one of these sprites got loaded at some point, overwriting part of Tails' sprite with one of Sonic's tiles.

I should point out that, which of the two characters wins the conflict boils down to whomever issues their DPLC request last. In the above scenario, Tails is stuck in a single frame, so there's no contest. But it can easily go the other way, and part of Sonic's sprite can be replaced by one of Tails' tiles.

On the left image, the tip of Tails' tail was overwritten by part of Sonic's fist, just as before. However, one frame later, on the right image, Tails has changed to a new mapping frame, causing all of his tiles to be refreshed and Sonic's fist to be overwritten by the tip of his tail.