diff --git a/src/mame/misc/smd2144c.cpp b/src/mame/misc/smd2144c.cpp
index 366e1da60ac..101ddd9a84e 100644
--- a/src/mame/misc/smd2144c.cpp
+++ b/src/mame/misc/smd2144c.cpp
@@ -13,7 +13,9 @@
 
 These games appear to be Tetris clones, but it wouldn't be surprising
 if they had stealth gambling games, too.
-Both dumped PCBs shared the same main CPU ROM and 2 of the 4 GFX ROMs. Same game with different GFX.
+Both dumped PCBs shared the same sound ROM and 2 of the 4 GFX ROMs.
+It seems they use the internal ROM of the H8S and thus not much can
+be done before it's dumped.
 */
 
 
@@ -55,7 +57,7 @@ uint32_t smd2144c_state::screen_update(screen_device &screen, bitmap_ind16 &bitm
 
 void smd2144c_state::program_map(address_map &map)
 {
-	map(0x000000, 0x07ffff).rom();
+	map(0x000000, 0x01ffff).rom();
 }
 
 
@@ -105,25 +107,32 @@ void smd2144c_state::smd2144c(machine_config &config)
 
 
 ROM_START( thecastle )
-	ROM_REGION(0x80000, "maincpu", 0)
-	ROM_LOAD( "tetrix 0a98.u3", 0x00000, 0x80000, CRC(7dc03a3f) SHA1(a2928dea91a68542fce932f986f288d269b3def3) ) // labeled Tetrix but game pics show 'The Castle'
+	ROM_REGION(0x20000, "maincpu", ROMREGION_ERASE00)
+	ROM_LOAD( "internal_flash_rom", 0x00000, 0x20000, NO_DUMP )
+
 
 	ROM_REGION(0x400000, "gfx", 0) // TODO: ROM loading not verified
 	ROM_LOAD( "mx27c8000.ic11", 0x000000, 0x100000, CRC(10cee0cb) SHA1(57daa974b9de38921a3c75edcf759cc803f22ec8) )
 	ROM_LOAD( "mx27c8000.ic12", 0x100000, 0x100000, CRC(d5940d05) SHA1(5a3e8eccaf1934d9ae6c0e01bb1745225929a627) )
 	ROM_LOAD( "mx27c8000.ic13", 0x200000, 0x100000, CRC(757d12b7) SHA1(8a7794c2bce70226dd047972a47fa1afec4bb0f1) )
 	ROM_LOAD( "mx27c8000.ic14", 0x300000, 0x100000, CRC(f1a0898d) SHA1(32c2ed41e2f04e3b7d756a15f6e476baeb641669) )
+
+	ROM_REGION(0x80000, "sounds", 0) // TODO: generated by what?
+	ROM_LOAD( "tetrix 0a98.u3", 0x00000, 0x80000, CRC(7dc03a3f) SHA1(a2928dea91a68542fce932f986f288d269b3def3) ) // labeled Tetrix but game pics show 'The Castle'
 ROM_END
 
 ROM_START( therock )
-	ROM_REGION(0x80000, "maincpu", 0)
-	ROM_LOAD( "the rock 1920.u3", 0x00000, 0x80000, CRC(7dc03a3f) SHA1(a2928dea91a68542fce932f986f288d269b3def3) ) // same as the castle set
+	ROM_REGION(0x20000, "maincpu", ROMREGION_ERASE00)
+	ROM_LOAD( "internal_flash_rom", 0x00000, 0x20000, NO_DUMP )
 
 	ROM_REGION(0x400000, "gfx", 0) // TODO: ROM loading not verified
 	ROM_LOAD( "mx27c8000.ic11", 0x000000, 0x100000, CRC(bc89920d) SHA1(904d4fae2f7d0172b06aca9ffa48a1bdfa42bf58) )
 	ROM_LOAD( "mx27c8000.ic12", 0x100000, 0x100000, CRC(ad496cb3) SHA1(ded21b9c60404a692d3c6d3f579fb7ecb0575a13) )
-	ROM_LOAD( "mx27c8000.ic13", 0x200000, 0x100000, CRC(757d12b7) SHA1(8a7794c2bce70226dd047972a47fa1afec4bb0f1) ) // same as the castle set
-	ROM_LOAD( "mx27c8000.ic14", 0x300000, 0x100000, CRC(f1a0898d) SHA1(32c2ed41e2f04e3b7d756a15f6e476baeb641669) ) // same as the castle set
+	ROM_LOAD( "mx27c8000.ic13", 0x200000, 0x100000, CRC(757d12b7) SHA1(8a7794c2bce70226dd047972a47fa1afec4bb0f1) ) // same as thecastle set
+	ROM_LOAD( "mx27c8000.ic14", 0x300000, 0x100000, CRC(f1a0898d) SHA1(32c2ed41e2f04e3b7d756a15f6e476baeb641669) ) // same as thecastle set
+
+	ROM_REGION(0x80000, "sounds", 0) // TODO: generated by what?
+	ROM_LOAD( "the rock 1920.u3", 0x00000, 0x80000, CRC(7dc03a3f) SHA1(a2928dea91a68542fce932f986f288d269b3def3) ) // same as thecastle set
 ROM_END
 
 } // Anonymous namespace
diff --git a/src/mame/pinball/by35.cpp b/src/mame/pinball/by35.cpp
index 4c4a75a486d..de711ec0bbb 100644
--- a/src/mame/pinball/by35.cpp
+++ b/src/mame/pinball/by35.cpp
@@ -68,7 +68,7 @@ Cybernaut                        0B42        Cheap Squeak
 Eight Ball Deluxe (reissue)      0B87
 Big Bat (BY133)                  ----        AS-2518-61 (Squawk & Talk)
 **** Bell ****
-Cosmic Flash
+Cosmic Flash                                 Modified Bally's Squawk & Talk
 Fantasy
 Fireball II
 Flash Gordon
@@ -99,7 +99,7 @@ Space Rider
 **** Grand Products ****
 301/Bullseye
 **** Arkon Automaten ****
-Sexy Girl
+Sexy Girl (ROMs are same as Bally's Playboy, uses an additional image projector)
 **** Elbos Electronics ****
 Genesis
 **** Zaccaria ****
@@ -2414,8 +2414,8 @@ ROM_START(cosflash)
 	ROM_CONTINUE( 0x5800, 0x0800)
 	ROM_RELOAD( 0x7000, 0x1000)
 	ROM_REGION(0x10000, "cpu2", 0)
-	ROM_LOAD("834-20_2.532", 0xc000, 0x1000, CRC(2f8ced3e) SHA1(ecdeb07c31c22ec313b55774f4358a9923c5e9e7))
-	ROM_LOAD("834-18_5.532", 0xf000, 0x1000, CRC(8799e80e) SHA1(f255b4e7964967c82cfc2de20ebe4b8d501e3cb0))
+	// This ROM contains an illegal opcode at $9B0 (02 instead of C6, LDI immediate). However it works correctly on real PCB. Marked bad until verified.
+	ROM_LOAD("cf-sound.532", 0xb000, 0x1000, BAD_DUMP CRC(7fda4f13) SHA1(9993ba890e91613014bad0950511bcff522b8dbd))
 ROM_END
 
 /*--------------------------------