Hard 119 mode principle + how to do on 991ES+

The method was discovered by trying different random valid Ram images until the screen is not turned on in reasonable time.

Note:
The buffer overflow happens when the number "0" is converted to a string, the allocated buffer is only 26 bytes long.
After the buffer, there's 2 bytes to store the old value of er14 (not important) and 4 bytes to store the return value.
The return address without corruption is 0:B9C2 (the representation on the stack is the 4 bytes: C2 B9 00 00), and the possible values of overflowed bytes are: (not tested very carefullly, but 0:3030 is definitely possible)
* .... 30 30 30 00 (FIX mode)
-->
00 b9 00 00 : 0:b900
30 00 00 00 : 0:0030
30 30 00 00 : 0:3030
* .... 30 30 ef bf 00 (SCI mode)
-->
bf 00 00 00 : 0:00bf
ef bf 00 00 : 0:bfef
30 ef bf 00 : 1:ef30
30 30 ef bf : 1:3030

Note:
The buffer overflow happens when the number "0" is converted to a string, the allocated buffer is only 26 bytes long.
After the buffer, there's 2 bytes to store the old value of er14 (not important) and 4 bytes to store the return value.
The return address without corruption is 0:B9C2 (the representation on the stack is the 4 bytes: C2 B9 00 00), and the possible values of overflowed bytes are: (not tested very carefullly, but 0:3030 is definitely possible)
* .... 30 30 30 00 (FIX mode)
-->
00 b9 00 00 : 0:b900
30 00 00 00 : 0:0030
30 30 00 00 : 0:3030
* .... 30 30 90 91 A0 00 (SCI mode)
-->
a0 00 00 00 : 0:00a0
91 a0 00 00 : 0:a091
90 91 a0 00 : 0:9190
30 90 91 a0 : 1:9030