Test 2

ldy 18 ce XXXX
ldab c6 YY
ldx off_ffb0 fe ff b0 update fix

jsr 0,x ad 00 fix
rtn 39

XXXX start address of read
YY length

I am sure this one will work. Than we can work out how to make an echo message of the upload.

If you want mode 6 response with aa

18 ce f4 9d c6 01 fe ff b0 ad 00 39