In IR_MOD, when the indirect word is TM_R and is a directOperand (DL or DU), the IWD tag is set to TM_R|TD_DL, and doAddrMod is exited. No idea why.
In IT_MOD, IT_CI /IT_SC/IT_SCR, if CT_HOLD is non-zero, characterOperandFlag, characterOperandSize and characterOperandOffset are restored from CT_HOLD, and doAddrMod is exited. These are used by readOPerands writeOperands to do sub-word reads/writes. At the end of IT_CI, they are stored in CT_HOLD.
Okay, I think what I was doing was handling faults in readOperands/writeOperands. If the IT_SC or IT_SCR addressing modes fault on the operand read/write, on instruction restart, the character number and tally fields will incorrectly be updated again.
Would it work to have those modes check the MIIF flag and reconstruct the flags without updating the tally and cf fields?