Fix CPU/DMA OAM access

verilog/rtl/boy.v

diff --git a/verilog/rtl/boy.v b/verilog/rtl/boy.v
index b437e09..819131d 100644
--- a/verilog/rtl/boy.v
+++ b/verilog/rtl/boy.v
@@ -394,6 +394,10 @@
             cpu_din = brom_dout;
         end 
         // -- These are shared between CPU and DMA --
+        else if (cpu_a >= 16'hfe00 && cpu_a <= 16'hfe9f) begin // OAM
+            oam_cpu_wr = cpu_wr;
+            cpu_din = (dma_occupy_bus) ? (8'hff) : (oam_dout);
+        end
         else if (cpu_a <= 16'hfdff) begin // External/ Work RAM/ Video RAM
             ext_cpu_wr = cpu_wr;
             cpu_din = (dma_occupy_bus) ? (8'hff) : (din);

verilog/rtl/dma.v

diff --git a/verilog/rtl/dma.v b/verilog/rtl/dma.v
index d384a53..2b0d924 100644
--- a/verilog/rtl/dma.v
+++ b/verilog/rtl/dma.v
@@ -94,16 +94,11 @@
                 count <= 8'd0;
             end
             DMA_DELAY: begin
-                if (ct == 2'b11) begin
-                    state <= DMA_TRANSFER_READ_ADDR;
+                if (ct == 2'b10) begin
+                    state <= DMA_TRANSFER_WRITE_WAIT;
                 end
             end
             DMA_TRANSFER_READ_ADDR: begin
-                dma_wr <= 1'b0;
-                cpu_mem_disable <= 1'b1;
-                // Load the temp register with data from memory
-                dma_a <= {dma_start_addr, count}; // Output read address
-                dma_rd <= 1'b1;
                 if (mmio_wr) begin // Allow re-triggering
                     state <= DMA_DELAY;
                     count <= 8'd0;
@@ -122,6 +117,7 @@
                 // Write the temp register to memory
                 dma_a <= {8'hfe, count}; // Output write address
                 dma_wr <= 1'b1;
+                count <= count + 8'd1;
                 if (mmio_wr) begin // Allow re-triggering
                     state <= DMA_DELAY;
                     count <= 8'd0;
@@ -138,11 +134,17 @@
                 else
                 if (count == 8'h9f) begin
                     state <= DMA_IDLE;
+                    cpu_mem_disable <= 1'b0;
                     count <= 8'd0;
                 end
                 else begin
                     state <= DMA_TRANSFER_READ_ADDR;
-                    count <= count + 8'd1;
+                    // Output address
+                    dma_wr <= 1'b0;
+                    cpu_mem_disable <= 1'b1;
+                    // Load the temp register with data from memory
+                    dma_a <= {dma_start_addr, count}; // Output read address
+                    dma_rd <= 1'b1;
                 end
             end
             default: begin