The sectors that don't read

Loaded the WOZ image into CiderPress II. Track 0 reads fine — it’s standard DOS 3.3 with a normal VTOC. Tracks 1 and 2 read fine. Track 3 onwards: the sector data is garbage, the checksums fail, and the sector headers look malformed.

First instinct: corrupt image. Checked the WOZ metadata — track lengths are non-standard. Track 3 is 6656 bytes where the standard is 6656 for a 16-sector track, but the bit timing is off. This isn’t a bad rip. The disk was written this way.

Dumped the raw nibble stream from track 3 and looked at the address field prologue sequences manually. The standard Apple II prologue is D5 AA 96. Track 3 uses D5 AA AD. One byte different. Every standard read routine in DOS 3.3 is checking for 96 and bailing out when it sees AD.

This is the first layer of the protection: non-standard address prologues. The standard DOS 3.3 RWTS won’t read these tracks at all. The game ships its own reader.

The custom reader must live in the code loaded from tracks 0–2. That’s the next thing to look at.

Status: tracks 0–2 fully readable; tracks 3–35 require custom read routine. Location of custom reader: unknown.