diff --git a/src/mame/drivers/cmmb.cpp b/src/mame/drivers/cmmb.cpp
index 14b88fa179d..0195fbef821 100644
--- a/src/mame/drivers/cmmb.cpp
+++ b/src/mame/drivers/cmmb.cpp
@@ -17,10 +17,13 @@ TODO:
 - finish video emulation;
 - trackball inputs
 - sound;
-- NVRAM (EEPROM) at U8 or U11 on PCB
+- NVRAM (flash ROM, as per NVRAM test at 0xC2A7).
 - untangle switch-cases for inputs;
-- Is the W65C02S the same as the 65SC02 core or are there any
-  extra Op-codes & addressing modes?
+- One bit of the control register seems to want to bank the flash into 2000-7FFF
+  which would require bankdev if verified.
+- IRQ handler is super-strange, it wants to JMP ($7FFE) and JMP ($3FFE) a lot,
+  which currently sends the game off into the weeds.
+- In fact, the game goes off into the weeds anyway right now due to doing that.
 
 Probably on the CPLD (CY39100V208B) - Quoted from Cosmodog's website:
  "Instead, we used a programmable chip that we could reconfigure very
@@ -80,6 +83,16 @@ public:
 	DECLARE_WRITE8_MEMBER(flash_dbg_0_w);
 	DECLARE_WRITE8_MEMBER(flash_dbg_1_w);
 
+	DECLARE_WRITE8_MEMBER(irq_ack_w)
+	{
+		m_maincpu->set_input_line(0, CLEAR_LINE);
+	}
+
+	DECLARE_WRITE8_MEMBER(irq_enable_w)
+	{
+		m_irq_mask = data & 0x80;
+	}
+
 	//DECLARE_READ8_MEMBER(kludge_r);
 	virtual void machine_reset() override;
 	virtual void video_start() override;
@@ -159,7 +172,9 @@ WRITE8_MEMBER(cmmb_state::cmmb_output_w)
 //          m_irq_mask = data & 0x80;
 			break;
 		case 0x02:
-			// bit 7 toggled - watchdog/eeprom?
+			// bit 7 toggled - watchdog or status LED
+			// toggled by code at E3DB in IRQ handler - it's on when the frame count & 0x30 is 1 and off otherwise
+			// bit 6 set means accessing flash ROM, possibly that entire 2000-7FFF banks over to the flash?
 			break;
 
 		case 0x03:
@@ -197,16 +212,19 @@ static ADDRESS_MAP_START( cmmb_map, AS_PROGRAM, 8, cmmb_state )
 	AM_RANGE(0x2001, 0x2001) AM_READ_PORT("IN4")
 	AM_RANGE(0x2011, 0x2011) AM_READ_PORT("IN5")
 	AM_RANGE(0x2480, 0x249f) AM_RAM_DEVWRITE("palette", palette_device, write8) AM_SHARE("palette")
+	AM_RANGE(0x2505, 0x2505) AM_WRITE(irq_enable_w)
+	AM_RANGE(0x2600, 0x2600) AM_WRITE(irq_ack_w)
 	//AM_RANGE(0x4000, 0x400f) AM_READWRITE(cmmb_input_r,cmmb_output_w)
 	//AM_RANGE(0x4900, 0x4900) AM_READ(kludge_r)
 	AM_RANGE(0x4000, 0x7fff) AM_ROMBANK("bank1")
-	AM_RANGE(0x8000, 0xffff) AM_ROM
+	AM_RANGE(0x8000, 0x9fff) AM_ROM AM_REGION("maincpu", 0x18000)
 	AM_RANGE(0xa000, 0xafff) AM_RAM
 	AM_RANGE(0xb000, 0xbfff) AM_READWRITE(cmmb_charram_r,cmmb_charram_w)
 	AM_RANGE(0xc000, 0xc00f) AM_READWRITE(cmmb_input_r,cmmb_output_w)
 	// debugging, to be removed
-	AM_RANGE(0x2aaa, 0x2aaa) AM_WRITE(flash_dbg_0_w)
-	AM_RANGE(0x5555, 0x5555) AM_WRITE(flash_dbg_1_w)
+//  AM_RANGE(0x2aaa, 0x2aaa) AM_WRITE(flash_dbg_0_w)
+//  AM_RANGE(0x5555, 0x5555) AM_WRITE(flash_dbg_1_w)
+	AM_RANGE(0xc010, 0xffff) AM_ROM AM_REGION("maincpu", 0x1c010)
 ADDRESS_MAP_END
 
 
@@ -373,12 +391,17 @@ GFXDECODE_END
 
 INTERRUPT_GEN_MEMBER(cmmb_state::vblank_irq)
 {
-//  if(machine().input().code_pressed_once(KEYCODE_Z))
-//      device.execute().set_input_line(INPUT_LINE_NMI, PULSE_LINE);
+	#if 0
+	if (m_irq_mask & 0x80)
+	{
+		m_maincpu->set_input_line(0, ASSERT_LINE);
+	}
+	#endif
 }
 
 void cmmb_state::machine_reset()
 {
+	m_irq_mask = 0;
 }
 
 
@@ -419,7 +442,8 @@ ROM_START( cmmb162 )
 	ROM_REGION( 0x50000, "maincpu", 0 )
 	ROM_LOAD( "cmmb162.u2",   0x10000, 0x40000, CRC(71a5a75d) SHA1(0ad7b97580082cda98cb1e8aab8efcf491d0ed25) )
 	ROM_COPY( "maincpu",      0x18000, 0x08000, 0x08000 )
-	ROM_FILL( 0x0c124, 2, 0xea ) // temporary patch, how irqs works for this?
+	ROM_FILL( 0x1c124, 2, 0xea ) // temporary patch to avoid waiting on IRQs
+	ROM_FILL( 0x1e3c3, 3, 0xea ) // patch out weird IRQ handler code that causes reboot each IRQ
 
 	ROM_REGION( 0x1000, "gfx", ROMREGION_ERASE00 )
 ROM_END