IIRC
there's some kind of multiplexer between the timing chain and the
 video RAM address lines (I can't remember if this is a real mux, or one
 of the Jupiter Ace type ones [1]). Maybe worth checking that's OK. 
 Will do.
You're right about it not being a real mux - a couple of 1k carbon
 resistors and a tristate buffer. YUCK! 
 
I thought it might be... Yuck (or Bletch!) is right :-)
    Obviously, if it thinks the RAM isn't set up
right, the stack is going to
 get pretty badly fudged. That shouldn't stop it from loading the CHG
 though... 
 Are you sure no stack or data memory is needed for this... 
  Er...
No. My Z80 is rusty. VERY rusty... 
 
Well, the stack is needed for CALL (or more strictly RET, in that a CALL
will get to tthe right place without the stack, but you'll never get back)
instructions, certainly. Does it call any subroutines (or use RSTs)
before loading the chargen?
  For it to load the chargen, the Wr/ and CS/
signals to the chargen RAM
 must be asseted at the same time, right? Can you attempt to detect this
 with the 'scop, maybe with an external OR (or NOR) gate? 
 I'll have to
snaffle a 40-series gate from my junkbox but it should be
 possible. I'll need to find a set of probes as well... 
 
4000 series CMOS may well not be fast enough for this -- you should get a
74LS32 or 74LS02, I think. You don't wnat problems caused by the test set-up.
In cany case, just chack that the CS/ line is not always asserted
(grounded). It might well be for something like the chargen or video
memory, since those are read out continuously to produce the display. If
that is the case, you just need to trigger on the Wr/ signal at the RAM
(which will be a combination of the Z80's Wr/ signal, the output from an
address decoder, and so on).
  If you can  trigger on that [2]  (assuming a good
'scope [3]), then maybe
 you can  look at the data going into the chargen, etc. 
 On a dual-channel scope?
Hmm... That's going to be fun... 
 
Well, if one bit is loading correctly it'll be a start...
  [2] A useful trick, I don't rememebr where I
learnt it, is to pulse the
 reset line at a few 10's of Hz. Slow enough that the machine does
 something after each reset, but fast enough that you get repetitive
 signals to look at on the non-storage 'scope. 
 Right. I'll grab a 555 from
the junkbox as well. 
 
Indeed :-)
  [3] A delayed timebase is very useful here....
 The 466 has a dual timebase with a Delay mode so I guess there's no problem
 there. 
 
Oh, if you have a Tektronix with 2 timebases and the delay time
multiplier control you'll be fine ;-)
-tony