diff --git a/emulator/firmware-decomp/emu860.py b/emulator/firmware-decomp/emu860.py
index 7c6d643..ff374aa 100644
--- a/emulator/firmware-decomp/emu860.py
+++ b/emulator/firmware-decomp/emu860.py
@@ -16,6 +16,7 @@ import dis860
 
 PAGE = 1 << 16
 MASK32 = 0xFFFFFFFF
+_INDEXED = os.environ.get('EMU_INDEXED', '0') == '1'   # experiment: register-indexed even loads
 
 def s16(v): return v - 0x10000 if v & 0x8000 else v
 def s26(v): return v - 0x4000000 if v & 0x2000000 else v
@@ -108,7 +109,7 @@ CTRL_NAMES = {0: 'fir', 1: 'psr', 2: 'dirbase', 3: 'db', 4: 'fsr', 5: 'epsr'}
 
 
 class I860:
-    DATA_BASE = 0x00000000     # .data/.bss linked low (code refs span 0xebc4..0x22644)
+    DATA_BASE = int(os.environ.get('EMU_DATA_BASE', '0'), 0)   # .data/.bss link base (experiment: sweep)
 
     def __init__(self, trace=0, logf=None):
         self.r = [0] * 32                 # integer regs (r0 == 0)
@@ -199,9 +200,11 @@ class I860:
         # pair): EA = base(src2) + s16(offset). Indexing is done by pre-computing
         # base+index into a register, then loading at offset 0. dest = bits20:16.
         if op in (0x00, 0x01, 0x04, 0x05, 0x08, 0x09):
-            m = 0xffff if op < 0x04 else (0xfff8 if op >= 0x08 else 0xfffc)
-            off = s16(imm & m)
-            ea = self.rd(src2) + off
+            if _INDEXED and not (op & 1):        # EVEN opcode = register-indexed (VR_REMOT.S)
+                ea = self.rd(src2) + self.rd(src1)
+            else:
+                m = 0xffff if op < 0x04 else (0xfff8 if op >= 0x08 else 0xfffc)
+                ea = self.rd(src2) + s16(imm & m)
             if op in (0x00, 0x01):        self.wr(dest, self.mem.r8(ea))     # ld.b (byte)
             elif op in (0x04, 0x05):      self.wr(dest, self.mem.r32(ea))    # ld.l
             else:                         self.fwr(dest, self.mem.r32(ea))   # fld.l