[rwmj]

> The poke address 23641 is probably some state variable of the BASIC interpreter and by writing to it you're messing up the state in a way that a RUN jumps into a specific place in the ROM which happens to run that LDDR.

Yes, it's the least significant byte of "E LINE Address of command being typed in" in the scratch area: https://worldofspectrum.org/ZXBasicManual/zxmanchap25.html It's cool that they documented all that stuff in the manual!

[jpecar]

And how does that lead to colorful flashing pattern that "collapses" some 30 seconds after it appears?