Further to my question, for future refence to others...

The solution is trivial.

The BIOS loads from BRAM even before any cartridge code is executed. So by simply setting the correct buffer address & size in the cartridge header, I have my loading done for me. Because I take over the machine in demo mode, the BIOS never loads it again.

For saving, all you need to do is fill the buffer and call $C12322. It reads the address & size from the header, and writes to the appropriate location in BRAM.

I'm supporting both BRAM and memory card load/save. I'm using the same buffer, and the BRAM data format is identical to the memory card data format. So I can use the memory card header information (game name) to determine if valid save data was read from BRAM before patching the high score table. I just need to work out a priority scheme for BRAM vs memory card... I guess memory card should take precedence if it's inserted (for reading)? And maybe I'll always attempt to write to both...

I guess I need to skip BRAM on the AES and skip memory card on the NGCD...

EDIT: don't rush off and implement this just yet... I've discovered it corrupts my title screen after the call...

EDIT: false alarm, the bug has nothing to do with the BRAM routine...