I have been trying to reproduce the startup problem and got some form of lead.
I created a barebones 3.1 A1200 030 with 32MB of ZIII fastram. It will crash pretty much immediately after startup.
In this config the WinUAE debugger seems to work. It even supports a form of "source level" debugging.
I.e. one can create a label in the source like 'Test:' and then in the debugger run
which will then break into the code at the line Test.
The commands 'z' and 't' let you single-step the code.
I followed the code until the crash... weirdly it happens when opening the Intuition window here
https://github.com/mheyer32/alienbre...eensetup.s#L46
Somewhere deep down in the OS code it copies some data from inaccessible addresses to somewhere else.