Finally! It looks like I may have fixed the emulator so that it will correctly run the OI29 software, in particular the GPCF stuff available through the 70-series SPEC pages. SPEC 71 is the one that was causing the most trouble, but it now appears to run correctly.
We found the problem yesterday, with the help of Roscoe and Paul from Flight Software. When we found the problem, though, it was late in the day so I left the fix for this morning. The fix turned out to be related to my earlier "fix", in which I realized that the intermediate addresses for the indirect addressing mode need to be expanded from 16 bits to 19 bits just like the final addresses are expanded.
When I added the code to expand these intermediate addresses, I made a real dumb mistake: I casted the 19-bit expanded address back down to an unsigned short, thus throwing away 3 bits of address. D'oh! Anyway, SPEC 71 no longer hoses the emulation, and I'm going to look at other places we expand address to see if I have any other address-truncation problems.