There are plenty of ways to pinpoint the issue. My script depended on a subroutine call that was nested in another subroutine call. Both calls had one 32-bit argument and a 32-bit return value. The outermost subroutine call always works; the innermost subroutine always fails with the argument being set to (or interpreted as) zero. I have not looked closely at the compiled code, but my best guess is that there is some address at which the failure occurs, probably at the boundary of an address bit. My test wasn't looking for this error, but there are plenty of ways to write a different test that can distinguish between a read and a write, or between address and data. Also, there is unique decode circuitry in the SoC handling the SRAM vs. the DFFRAM, so I cannot say for certain that the error is in the SRAM as opposed to any of the logic in the SoC unique to the SRAM access.