SF4 6116+16L8 photo was taken from the auction, but unfortunatelly the seller did not send me the bottom side photo, which would make things much easier. From what I can say that MMC3 epoxy blob for sure omits PRG & CIR-A10 lines, which must be then controlled by PAL.
I initially thought this RAM was used as a 4 byte register for the copy protection mechanism, but that would require some kind of switching between RAM data, CPU data lines lines and PAL and for sure, PAL has not enough pins for that.
So my guess is that this RAM is enabled either for $6000-$7fff or $4800-$5fff and it is initialized by some kind of routine and then when original code jumps to $5000-$5004, RAM is enabled for that region.
PAL has enough lines for do all the job:
[code]
.---v---.
CPU A11 -> |01 20| -- +5V
CPU A12 -> |02 19| -> PRG A15
CPU A13 -> |03 18| -> PRG A16
|04 17| -> WRAM /CE
CPU R/W -> |05 16| <- M2
CPU A14 -> |06 15| -> CPU /ROMSEL
CPU D0 -> |07 14| -> (internal feedback loop for $4800.5)
CPU D5 -> |08 13| <- PPU A11
CPU D4 -> |09 12| -> CIR A10
GND -- |10 11| <- PPU A10
'-------'
PAL16L8 (**wild guess**)
[/code]