Genplus-gx access violation

Summary

Genplus-gx core crashes with an access violation if it is loaded with a Sega Master System or Game Gear rom, but only if certain roms were loaded before it.

The person who discovered this on Discord suggested it's related to systems that have associated firmware files, but that doesn't seem to be all of it.

I'm getting consistent crashes if I first load Mega Man 1 (on NesHawk OR quickerNES) and then load "Shinobi" (SMS on GPGX) or Mega Man (GG on GPGX).
But I'm not seeing crashes if I load Anticipation (NES on either core) before an SMS/GG game.
I'm also getting crashes if I first load Mega Man (NES), then Anticipation (NES), and then Shinobi (SMS).
Not getting crashes when loading multiple SMS/GG games after another on GPGX, but I am getting a crash when loading a Sega CD game on GPGX first.
Not getting crashes with any of the SNES games I tested.

Bisect points to 7acd38983ad3e64935e31daa02943fe1558e3921, though I can't see how those lines of code could cause this issue. The crash occurs during the first call to gpgx_advance, and gpgx_reset is never even called as far as I can tell. Maybe something borked with the wbx? Still haven't learned how to debug or rebuild these.

Repro

1. Load Mega Man (U) (NES, any core)
2. Load Shinobi (U) (SMS on Genplus-gx)
3. Hard crash (uncaught access violation)

Output

Visual Studio wasn't helpful for me, but Windbg spits out this as the apparent culprit:

(fcb4.8214): Access violation - code c0000005 (!!! second chance !!!)
0000036f`001d9f3c 890a            mov     dword ptr [rdx],ecx ds:00000000`00000000=????????

Host env.

• BizHawk from 7acd38983ad3e64935e31daa02943fe1558e3921 onwards, Win11

Start by reproducing the listed Mega Man NES to Shinobi SMS sequence and inspect the first call to gpgx_advance under WinDbg. Compare behavior around commit 7acd38983ad3e64935e31daa02943fe1558e3921, noting that gpgx_reset is reportedly not reached; done means the cross-core loading sequence no longer causes an access violation.