This is an incomplete list of the allocation of address space in 'zero page'.
  It is currently maintained by Matthew Wilcox <mrw103@york.ac.uk> and is
  available as ftp://ftp.barnet.ac.uk/pub/Acorn/zeropage.txt or as
  http://www.york.ac.uk/~mrw103/zeropage.txt.  If you can't get it using
  either of these methods then mail me, asking *nicely*.  Please mail me any
  corrections or additions to me so they can be incorporated into the list.
  I would be particularly interested in differences in other versions of RISC
  OS.  Last updated on Mon 07th October 1996

  Credits (alphabetically):
  Carol Carpenter for providing space on Barnet's FTP site for this document
  Ben Dooks for telling me the base of the Vector table & for writing VecList
  Nick Smith for reading RAM speed & MEMC type from zero page in !ArmSI
  Mark Wooding for mentioning that DDEUtils frobbed around in zero page

  All addresses are given in hexadecimal and refer to the start of the word
  containing the value.  Where a range is given, it is given to the beginning
  of the last word in the range.  These addresses were valid on my 4Mb A440
  running RISC OS 3.1.  None of them are guaranteed to remain in the same
  place between different versions of the OS.  Some will definitely be
  different under RISC OS 3.5+.  Always use the defined system interfaces in
  preference to direct accesses if possible.  No liability is assumed for any
  loss or damage which may result as the result of yourself or others use or
  misuse of the information contained in this document.

  Address        Contents

  0         Branch Through Zero handler
  4         Undefined Instruction handler
  8         Software Interrupt handler
  C         Prefetch Abort handler
  10        Data Abort handler
  14        Address Exception handler
  18        IRQ handler
  1C - FC        FIQ routine
  100       Address called by ROM IRQ handler routine. (&C34)
  104  Bit 4     Escape condition occured
  108       Value of R13_irq after last IRQ happened
  10C       Monotonic time
  110  Byte 0    } RAM speed
       Byte 1    }
       Bit 16    MEMC1 if clear, MEMC1a if set
  114  Bit 2     } used by OS_SetMemMapEntries.  Not understood how.
       Bit 3     }
  118       [has value 0.  Is it unused?]
  11C       MemoryLimit value
  120       Undefined instruction handler address
  124       Prefetch abort handler address
  128       Data abort handler address
  12C       Address exception handler address
  130       Error handler address
  134       Error buffer address
  138       R0 on entry to Error handler
  13C       R12 on entry to CallBack handler
  140       CallBack handler address
  144       Pointer to CallBack register buffer
  148       R12 on entry to BreakPoint handler
  14C       BreakPoint handler address
  150       Pointer to BreakPoint register buffer
  154       R12 on entry to Escape handler
  158       Escape handler address
  15C       R12 on entry to Event handler
  160       Event handler address
  164 - 360 Page tables.  Top nybble contains page protection level

  364 - 560 Here be dragons.  All zero, too.  Unused?

  564       Address of page tables
  568       Highest page number
  56C       Total amount of RAM in machine in bytes
  570       Application space
  574       R12 on entry to Unused SWI handler
  578       Unused SWI handler address
  57C       Exit handler address
  580       R12 on entry to Exit handler
  584       R12 on entry to UpCall handler
  588       UpCall handler address
  58C
  590
  594
  598  Byte 0
       Byte 1
       Byte 2
       Byte 3    Keyboard ID
  59C
  5A0
  5A4
  5A8
  5AC
  5B0
  5B4
  5B8
  5BC
  5C0       Mouse X multiplier
  5C4       Mouse Y multiplier
  5C8       Address of keyboard handler

  5CC - 7CC The Great Swamp

  7D0       Pointer to Module chain
  7D4       Currently Active Object pointer
  7D8       UserV          (00)
  7DC       ErrorV         (01)
  7E0       IrqV      (02)
  7E4       WrchV          (03)
  7E8       RdchV          (04)
  7EC       CLIV      (05)
  7F0       ByteV          (06)
  7F4       WordV          (07)
  7F8       FileV          (08)
  7FC       ArgsV          (09)
  800       BGetV          (0A)
  804       BPutV          (0B)
  808       GBPBV          (0C)
  80C       FindV          (0D)
  810       ReadLineV (0E)
  814       FSCV      (0F)
  818       EventV         (10)
  81C       *V        (11) }
  820       *V        (12) } These vectors reserved by Acorn
  824       *V        (13) }
  828       InsV      (14)
  82C       RemV      (15)
  830       CnpV      (16)
  834       UKVDU23V  (17)
  838       UKSWIV         (18)
  83C       UKPLOTV        (19)
  840       MouseV         (1A)
  844       VDUXV          (1B)
  848       TickerV        (1C)
  84C       UpcallV        (1D)
  850       ChngEnvirnmentV     (1E)
  854       SpriteV        (1F)
  858       DrawV          (20)
  85C       EconetV        (21)
  860       ColourV        (22)
  864       PaletteV  (23)
  868       SerialV        (24)
  86C       *V        (25) }
  870       *V        (26) }
  874       *V        (27) }
  878       *V        (28) }
  87C       *V        (29) }
  880       *V        (2A) } These vectors reserved by Acorn
  884       *V        (2B) }
  888       *V        (2C) }
  88C       *V        (2D) }
  890       *V        (2E) }
  894       *V        (2F) }
  898       Pointer to exception registers

  89C - A38 Garroting Deep

  A3C  Byte 0
       Byte 1
       Byte 2
       Byte 3    [referred to by ROM PaletteV]

  A40 - AC8 Northron Climbs

  ACC       Current size of sprite area
  AD0       Current size of RAM filing system
  AD4       Current size of font cache
  AD8       Base of OS_CallEvery/CallAfter list
  ADC       first 4 bytes of time that program was started
  AE0  Byte 0    last byte of time that program was started
       Byte 1    input file handle
       Byte 2    output file handle
       Byte 3
  AE4  Bit 8     } [referenced by kernel swi exit routines]
       Bit 9     }
       Bit 10    Outstanding OS_AddCallback.
       Bit 16    IOEB ASIC present
       Bit 17    82C710 present
       Bit 18    LCD ASIC present
       Bit 19    82C711 present
  AE8-BE4        Program environment string
  BE8
  BEC
  BF0
  BF4
  BF8
  BFC
  C00
  C04
  C08
  C0C
  C10
  C14
  C18
  C1C
  C20
  C24
  C28       page size in bytes
  C2C
  C30
  C34       MOV  r3, #&03200000      }
  C38       LDRB r0, [r3, #36]       }
  C3C       CMP  r0, #0              }
  C40       LDREQB    r0, [r3, #20]        }
  C44       ADREQ     r1, &D24       } IRQ handler routine
  C48       ADRNE     r1, &E24       }
  C4C       LDRB r0, [r1, r0]        }
  C50       ADD  r1, pc, r0, LSL #2  }
  C54       LDMIA     r1, {r12, pc}        }
  C58       R12 value for device 0 vector
  C5C       Address of device 0 handler
  C60       points to next handler for device 0
  C64       R12 value for device 1 vector
  C68       Address of device 1 handler
  C6C       points to next handler for device 1
  C70       R12 value for device 2 vector
  C74       Address of device 2 handler
  C78       points to next handler for device 2
  C7C       R12 value for device 3 vector
  C80       Address of device 3 handler
  C84       points to next handler for device 3
  C88       R12 value for device 4 vector
  C8C       Address of device 4 handler
  C90       points to next handler for device 4
  C94       R12 value for device 5 vector
  C98       Address of device 5 handler
  C9C       points to next handler for device 5
  CA0       R12 value for device 6 vector
  CA4       Address of device 6 handler
  CA8       points to next handler for device 6
  CAC       R12 value for device 7 vector
  CB0       Address of device 7 handler
  CB4       points to next handler for device 7
  CB8       R12 value for device 8 vector
  CBC       Address of device 8 handler
  CC0       points to next handler for device 8
  CC4       R12 value for device 9 vector
  CC8       Address of device 9 handler
  CCC       points to next handler for device 9
  CD0       R12 value for device 10 vector
  CD4       Address of device 10 handler
  CD8       points to next handler for device 10
  CDC       R12 value for device 11 vector
  CE0       Address of device 11 handler
  CE4       points to next handler for device 11
  CE8       R12 value for device 12 vector
  CEC       Address of device 12 handler
  CF0       points to next handler for device 12
  CF4       R12 value for device 13 vector
  CF8       Address of device 13 handler
  CFC       points to next handler for device 13
  D00       R12 value for device 14 vector
  D04       Address of device 14 handler
  D08       points to next handler for device 14
  D0C       R12 value for device 15 vector
  D10       Address of device 15 handler
  D14       points to next handler for device 15
  D18       R12 value for no device
  D1C       address of no device handler
  D20       points to next handler for no device
  D24 - E20 IRQ register A priority table
  E24 - F20 IRQ register B priority table
  F24       Base of AddCallBack list
  F28
  F2C
  F30
  F34
  F38
  F3C
  F40
  F44
  F48
  F4C
  F50
  F54
  F58
  F5C
  F60
  F64       Unique Machine ID word 0
  F68       Unique Machine ID word 1
  F6C
  F70
  F74
  F78
  F7C
  F80  Byte 0    Kernel flag to prevent reentering MessageTrans_ErrorLookup
       Byte 1
       Byte 2
       Byte 3
  F84
  F88
  F8C
  F90
  F94
  F98
  F9C
  FA0
  FA4
  FA8
  FAC
  FB0
  FB4
  FB8
  FBC
  FC0
  FC4
  FC8
  FCC
  FD0
  FD4
  FD8
  FDC
  FE0
  FE4
  FE8
  FEC
  FF0
  FF4
  FF8       Bottom 16 bits of task handle
  FFC

  It appears to me that everything VDU related is stored after &1000.

  1000
  1004
  1008
  100C
  1010
  1014
  1018
  101C
  1020
  1024
  1028
  102C
  1030
  1034
  1038
  103C
  1040      GCOL action for foreground colour [151]
  1044      GCOL action for background colour [152]
  1048      Graphics foreground colour [153]
  104C      Graphics background colour [154]
  1050      Left-hand column of the graphics window [128]
  1054      Bottom row of the graphics window [129]
  1058      Right-hand column of the graphics window [130]
  105C      Top row of the graphics window [131]
  1060
  1064
  1068
  106C
  1070
  1074
  1078
  107C      Amount of RAM required by current screen mode
  1080
  1084
  1088      [referenced by RemoveCursors]
  108C
  1090      [referenced by RemoveCursors]
  1094
  1098
  109C
  10A0      [referenced by SetECFOrigin]
  10A4
  10A8
  10AC
  10B0
  10B4      [referred to by ROM PaletteV]
  10B8
  10BC
  10C0      Address of the start of screen used by VDU drivers [148]
  10C4      [referenced by SetECFOrigin]
  10C8
  10CC
  10D0
  10D4
  10D8
  10DC
  10E0      Left-hand column of the text window [132]
  10E4      Bottom row of the text window [133]
  10E8      Right-hand column of the text window {134]
  10EC      Top row of the text window [135]
  10F0      x coordinate of the graphics origin (ec) [136]
  10F4      y coordinate of the graphics origin (ec) [137]
  10F8      x coordinate of the graphics cursor (ec) [138]
  10FC      y coordinate of the graphics cursor (ec) [139]
  1100      x coordinate of oldest graphics cursor (ic) [140]
  1104      y coordinate of oldest graphics cursor (ic) [141]
  1108      x coordinate of previous graphics cursor (ic) [142]
  110C      y coordinate of previous graphics cursor (ic) [143]
  1110      x coordinate of the graphics cursor (ic) [144]
  1114      y coordinate of the graphics cursor (ic) [145]
  1118      x coordinate of new point (ic) [146]
  111C      y coordinate of new point (ic) [147]
  1120      Text foreground colour [155]
  1124      Text background colour [156]
  1128
  112C
  1130      [referenced by RemoveCursors]
  1134
  1138
  113C      [referenced by RemoveCursors]
  1140
  1144
  1148
  114C
  1150
  1154
  1158
  1160
  1164
  1168
  116C
  1170
  1174
  1178      Address of the start of screen used by display hardware [149]
  117C
  1180
  1184      Highest logical colour number available in this mode
  1188
  118C
  1190
  1194
  1198
  119C
  11A0
  11A4
  11A8
  11AC
  11B0
  11B4
  11B8
  11BC
  11C0
  11C4
  11C8
  11CC
  11D0      Current screen mode number
  11D4      Tint for text foreground colour [159]
  11D8      Tint for text background colour [160]
  11DC      Tint for graphics foreground colour [157]
  11E0      Tint for graphics background colour [158]
  11E4      Amount of memory currently allocated to the screen [150]
  11E8      Highest mode number available [161]
  11EC
  11F0 Bit 0     [referenced by ReadVduVars]
       Bit 1     [referenced by ReadVduVars]
       Bit 2     [referenced by ReadVduVars]
       Bit 3     text printing direction vertical if set
       Bit 9     Cursor state
       Bit 21    ChangedBox calculation enabled if set
       Bit 30    [referenced by ReadVduVars]
  11F4      [referenced by RemoveCursors]
  11F8
  11FC
  1200
  1204
  1208
  120C
  1210
  1214
  1218
  121C
  1220
  1224
  1228      VIDC clock speed in kHz [172]

  122C - 135C    Treacher's Gorge

  1360      x size of VDU 5 chars (in pixels) [162]
  1364      y size of VDU 5 chars (in pixels) [163]
  1368      x spacing of VDU 5 chars (in pixels) [164]
  136C      y spacing of VDU 5 chars (in pixels) [165]
  1370      x size of VDU 4 chars (in pixels) [167]
  1374      y size of VDU 4 chars (in pixels) [168]
  1378      x spacing of VDU 4 chars (in pixels) [169]
  137C      y spacing of VDU 4 chars (in pixels) [170]
  1380      Address of fast line-draw routine [166]
  1384      Address of colour blocks for current GCOLs [171]

  1388 - 159C    Spoiled Plains

  15A0 Byte 0    ClaimScreenMemory flag
       Byte 1
       Byte 2
       Byte 3

  15A4 - 1668    Doriendor Corishev

  166C      ChangedBox flag word
  1670      ChangedBox x coordinate of left edge
  1674      ChangedBox y coordinate of bottom edge
  1678      ChangedBox x coordinate of right edge
  167C      ChangedBox y coordinate of top edge

  1680 - 3FFC    Trackless wastes

  4000-7FFC RISC OS scratch space