DMA source address register lock-up

[Sik]

Kabuto reported that writing to the upper byte of the DMA source address, then issuing a non-DMA command, will result in the 68000 hanging up (or something along those lines).

Looking at the code, it seems that t1 is set when that register is written to and set up for DMA transfer, and reset when the CPU grants the bus (which only happens when DMA is initiated). So I imagine that the mechanism that results in a lock-up is t1 remaining set when the VDP didn't expect it to? The question then is what does t1 do that prevents the VDP from letting go of the bus as usual later.

Also the implication here is that DMA copy and DMA fill should be immune from this hardware bug.