diff --git a/README.md b/README.md
index 42cf1e3..29091fb 100644
--- a/README.md
+++ b/README.md
@@ -26,4 +26,4 @@ There are at least three significant compatibility bugs in the 6.0 Franklin ROMs
 
 * With 80-column/enhanced firmware active, once MouseText is activated (via outputting $1B), attempting to turn it off by outputting $18 fails. This affects both the 2X00 and 500. Root cause identified, fix identified, and (optionally) applied.
 * With 80-column/enhanced firmware active, horizontal cursor position must use `OURCH` ($57B) not `CH` ($24). This affects only the 2X00. This is documented by Apple, but real Apples, the Laser 128, and Franklin ACE 500 all support using just `CH` via clever firmware routines. Root cause identified, fix found in the 500 ROM and (optionally) applied to the 2X00 ROMs.
-* With 80-column/enhanced firmware active, sending bytes $40-$5F through C3COut1 will appear as MouseText, whereas on real Apples they are mapped to inverse uppercase. This affects both the 2X00 and 500. Root cause identified, fix pending.
+* With 80-column/enhanced firmware active, sending bytes $40-$5F through C3COut1 will appear as MouseText, whereas on real Apples they are mapped to inverse uppercase. This affects both the 2X00 and 500. Root cause identified, tentative fix identified and (optionally) applied.
diff --git a/ace2000_c300_cfff.s b/ace2000_c300_cfff.s
index 573d871..e8f7b33 100644
--- a/ace2000_c300_cfff.s
+++ b/ace2000_c300_cfff.s
@@ -3,7 +3,6 @@
 ; Input file: Franklin_Ace2000_ROM_U2_P2_Rev6.bin
 ; Page:       1
 
-
         .setcpu "65C02"
         .include "opcodes.inc"
         .feature string_escapes
@@ -11,6 +10,7 @@
 ;;; Set to 1 to include preliminary fixes for:
 ;;; * MouseText mode failing to exist on $18 output.
 ;;; * CH not working to set horizontal cursor position.
+;;; * MouseText displaying if $40-$5F sent to COUT.
 INCLUDE_PATCHES = 0
 
 ;;; Zero Page
@@ -528,7 +528,7 @@ LC4CE:  bbr0    $F0,LC4AB
 
 ;;; ============================================================
 
-        .res $C800 - *, 0
+        .res    $C800 - *, 0
 
 ;;; ============================================================
 
@@ -566,6 +566,7 @@ Do40Col:
 
 ;;; ============================================================
 
+.if !INCLUDE_PATCHES
         nop
         nop
         nop
@@ -583,6 +584,19 @@ Do40Col:
         nop
         nop
         nop
+.else
+Patch4:
+        lda     CHAR            ; char to be printed
+        bit     INVFLG
+        bmi     :+              ; normal
+        and     #$7F            ; clear high bit
+:       and     #$FF            ; set N flag
+        rts
+.endif
+
+;;; ============================================================
+
+        .res    $C84D - *, 0
 
 ;;; ============================================================
 
@@ -666,16 +680,15 @@ LC8B4:  jsr     CheckPauseListing
         ;; If MouseText is not active, make sure to map inverse
         ;; uppercase range to the control character range.
 
-        ;; BUG: If a char in $00-$7F is passed to C3COut1 and
-        ;; not in inverse mode, the mapping will not occur. This
-        ;; does not happen with the Apple firmware, as the
-        ;; high bit is folded into the char based on INVFLAG,
-        ;; then the corresponding test is based only on the
-        ;; char's high bit. This affects Copy II Plus 8.4's
-        ;; Catalog / tree view.
-
-@l2:    lda     CHAR            ; char to be printed
+@l2:
+.if !INCLUDE_PATCHES
+        lda     CHAR            ; char to be printed
         bit     INVFLG          ; inverse?
+.else
+        jsr     Patch4          ; sets N flag if inverse char
+        nop
+        nop
+.endif
         bmi     @l3             ; no, so not MT, just print it
 
         and     #$7F
@@ -1856,6 +1869,10 @@ UnknownEP1:
         bne     :-
 @l15:   jmp     @l9
 
+;;; ============================================================
+
+        .assert * = $CFE7, error, "Something changed size"
+
 ;;; ============================================================
 
 .if INCLUDE_PATCHES
diff --git a/ace500_c300_cfff.s b/ace500_c300_cfff.s
index 1585a47..f665a76 100644
--- a/ace500_c300_cfff.s
+++ b/ace500_c300_cfff.s
@@ -9,6 +9,7 @@
 
 ;;; Set to 1 to include preliminary fixes for:
 ;;; * MouseText mode failing to exist on $18 output.
+;;; * MouseText displaying if $40-$5F sent to COUT.
 INCLUDE_PATCHES = 0
 
 ;;; Zero Page
@@ -1070,8 +1071,15 @@ LC84C:  jsr     CheckPauseListing
         ;; If MouseText is not active, make sure to map inverse
         ;; uppercase range to the control character range.
 
-@l2:    lda     CHAR            ; char to be printed
+@l2:
+.if !INCLUDE_PATCHES
+        lda     CHAR            ; char to be printed
         bit     INVFLG          ; inverse?
+.else
+        jsr     Patch4          ; sets N flag if inverse char
+        nop
+        nop
+.endif
         bmi     @l3             ; no, so not MT, just print it
 
         and     #$7F
@@ -2134,8 +2142,7 @@ LCED2:
 
 ;;; ============================================================
 
-        ;; ???
-
+.if !INCLUDE_PATCHES
         .byte   "EN\r"
         .byte   "\tASL\tWIDTH\r"
         .byte   "\tSTA\tON80ST\tMAKE SURE 80 STORE IS ENABLED\r"
@@ -2153,6 +2160,17 @@ LCED2:
         .byte   "\r"
         .byte   "\x1F"
         .byte   "\r;E"
+.else
+
+Patch4:
+        lda     CHAR            ; char to be printed
+        bit     INVFLG
+        bmi     :+              ; normal
+        and     #$7F            ; clear high bit
+:       and     #$FF            ; set N flag
+        rts
+
+.endif
 
 ;;; ============================================================