Here's the problem I was trying to get to the bottom of:
There are two overlapping ranges when the payload starts:
0:18.1 B4 & BC B8 & BC
BASE LIMIT
00FD0003 00FE1F00
00FC0003 00FFFF00
In v2 there's only one at that point.
There are also extra mappings in IO space, but they are zero size.
It's very possible that it makes no difference. It just makes it harder to read the address map with extra entries.
Thanks, Myles