diff --git a/presets/nes/shoot2.c b/presets/nes/shoot2.c
index bd281532..0f2b8d2f 100644
--- a/presets/nes/shoot2.c
+++ b/presets/nes/shoot2.c
@@ -696,7 +696,7 @@ void init_stars() {
   byte oamid = 0; // 32 slots = 128 bytes
   byte i;
   for (i=0; i<32; i++) {
-    oamid = oam_spr(rand(), i*8, 103+(i&3), 0, oamid);
+    oamid = oam_spr(rand(), i*8, 103+(i&3), 0|OAM_BEHIND, oamid);
   }
 }
 
diff --git a/presets/nes/vrambuf.c b/presets/nes/vrambuf.c
index 5920e692..d76ed134 100644
--- a/presets/nes/vrambuf.c
+++ b/presets/nes/vrambuf.c
@@ -5,17 +5,19 @@
 // index to end of buffer
 byte updptr = 0;
 
-// add EOF marker to buffer
+// add EOF marker to buffer (but don't increment pointer)
 void cendbuf(void) {
   updbuf[updptr] = NT_UPD_EOF;
 }
 
+// clear vram buffer and place EOF marker
 void cclearbuf(void) {
   updptr = 0;
   cendbuf();
 }
 
-// flush buffer now, waiting for next frame
+// wait for next frame, then clear buffer
+// this assumes the NMI will call flush_vram_update()
 void cflushnow(void) {
   // make sure buffer has EOF marker
   cendbuf();
@@ -29,18 +31,18 @@ void cflushnow(void) {
 // add multiple characters to update buffer
 // using horizontal increment
 void putbytes(word addr, const char* str, byte len) {
+  byte i;
   // if bytes won't fit, wait for vsync and flush buffer
   if (updptr >= VBUFSIZE-4-len) cflushnow();
   // add vram address
-  updbuf[updptr] = (addr >> 8) ^ NT_UPD_HORZ;
-  updbuf[++updptr] = addr & 0xff;
+  VRAMBUF_ADD((addr >> 8) ^ NT_UPD_HORZ);
+  VRAMBUF_ADD(addr); // only lower 8 bits
   // add length
-  updbuf[++updptr] = len;
-  // add bytes
-  while (len--) {
-    	updbuf[++updptr] = *str++;
+  VRAMBUF_ADD(len);
+  // add data
+  for (i=0; i<len; ++i) {
+    	VRAMBUF_ADD(str[i]);
   }
-  ++updptr;
-  // add EOF mark
+  // place EOF mark
   cendbuf();
 }
diff --git a/presets/nes/vrambuf.h b/presets/nes/vrambuf.h
index 5f8fd68e..38f2339b 100644
--- a/presets/nes/vrambuf.h
+++ b/presets/nes/vrambuf.h
@@ -13,22 +13,27 @@
 // index to end of buffer
 extern byte updptr;
 
-// macros
+// macro to add a multibyte header
 #define VRAMBUF_PUT(addr,len,flags)\
-  updbuf[updptr++] = ((addr) >> 8) | (flags);\
-  updbuf[updptr++] = (addr) & 0xff;\
-  updbuf[updptr++] = (len);
+  VRAMBUF_ADD(((addr) >> 8) | (flags));\
+  VRAMBUF_ADD(addr);\
+  VRAMBUF_ADD(len);
 
+// macro to add a single byte to buffer
 #define VRAMBUF_ADD(b)\
-  updbuf[updptr++] = (b);
+  __A__ = (b);\
+  asm("ldy %v", updptr);\
+  asm("sta $100,y");\
+  asm("inc %v", updptr);
 
-// add EOF marker to buffer
+// add EOF marker to buffer (but don't increment pointer)
 void cendbuf(void);
 
-// clear update buffer
+// clear vram buffer and place EOF marker
 void cclearbuf(void);
 
-// flush buffer now, waiting for next frame
+// wait for next frame, then clear buffer
+// this assumes the NMI will call flush_vram_update()
 void cflushnow(void);
 
 // add multiple characters to update buffer
diff --git a/src/platform/nes.ts b/src/platform/nes.ts
index 3714e4a6..a8f16f37 100644
--- a/src/platform/nes.ts
+++ b/src/platform/nes.ts
@@ -24,7 +24,7 @@ const JSNES_PRESETS = [
   {id:'metatrigger.c', name:'Trigger Mode + Vbright'},
   {id:'neslib5.c', name:'RLE Unpack'},
   {id:'statusbar.c', name:'Split Status Bar'},
-  {id:'horizmask.c', name:'Horizontal Scrolling'},
+  {id:'horizmask.c', name:'Offscreen Scrolling'},
   {id:'music.c', name:'Music Player'},
   {id:'siegegame.c', name:'Siege Game'},
   {id:'shoot2.c', name:'Solarian Game'},
diff --git a/tss b/tss
index 5b5ee67f..d630ddcb 160000
--- a/tss
+++ b/tss
@@ -1 +1 @@
-Subproject commit 5b5ee67fc06956bc7dce51726e98812d2d897eaa
+Subproject commit d630ddcb29d74a178cde043d74188fac35d6a21f