While making a clean-up pass (of resolving addresses), I came across a routine at 0xF5ED that prints the message "Attached to Mac, emulating keyboard." or "Attached to PC, emulating keyboard.".  Which message is governed by bit 0 in loc 0x008a.  I should be able to trace cross references into this function, and to that memory location, to help map out the keyboard emulation code.

Also, creating a data segment for special function registers (SFR) and internal RAM (IRAM)
Tired of scrolling through the datasheet to figure out SFR addresses, I added a data segment 0x0000-0x003f and spent a little time labelling those locations.  This is tedious, but it helps a lot because the symbolic names then propagate through the disassembly.  Ultimately, I needed to do this for the the IRAM data anyway (and also the external RAM once I figure out where it is mapped), so might as well get started.

0000 ??          PORTA_0:        rmb 1
0001 ??                          rmb 1  ; (reserved)
0002 ??          PIOC_2:         rmb 1
0003 ??          PORTC_3:        rmb 1
0004 ??          PORTB_4:        rmb 1
0005 ??                          rmb 1  ; (reserved)
0006 ??          DDRB_6:         rmb 1
0007 ??          DDRC_7:         rmb 1
0008 ??          PORTD_8:        rmb 1
0009 ??          DDRD_9:         rmb 1
000A ??                          rmb 1  ; (reserved)
000B ??          CFORC_B:        rmb 1
000C ??          OC1M_C:         rmb 1
000D ??          OC1D_D:         rmb 1
000E ?? ??       TCNT_E:         rmb 2
0010 ?? ??       TIC1_10:        rmb 2
0012 ?? ??       TIC2_12:        rmb 2
0014 ?? ??       TIC3_14:        rmb 2
0016 ?? ??       TOC1_16:        rmb 2
0018 ?? ??       TOC2_18:        rmb 2
001A ?? ??       TOC3_1A:        rmb 2
001C ?? ??       TOC4_1C:        rmb 2
001E ?? ??       TI4O5_1E:       rmb 2
0020 ??          TCTL1_20:       rmb 1
0021 ??          TCTL2_21:       rmb 1
0022 ??          TMSK1_22:       rmb 1
0023 ??          TFLG1_23:       rmb 1
0024 ??          TMSK2_24:       rmb 1
0025 ??          TFLG2_25:       rmb 1
0026 ??          PACTL_26:       rmb 1
0027 ??          PACNT_27:       rmb 1
0028 ??          SPCR_28:        rmb 1
0029 ??          SPSR_29:        rmb 1
002A ??          SPDR_2A:        rmb 1
002B ??          BAUD_2B:        rmb 1
002C ??          SCCR1_2C:       rmb 1
002D ??          SCCR2_2D:       rmb 1
002E ??          SCSR_2E:        rmb 1
002F ??          SCDR_2F:        rmb 1
0030 ?? ?? ?? ??+                rmb 9  ; (reserved)
0039 ??          OPTION_39:      rmb 1
003A ??          COPRST_3A:      rmb 1
003B ??          PPROG_2B:       rmb 1
003C ??          HPRIO_3C:       rmb 1
003D ??          INIT_3D:        rmb 1
003E ??          TEST_3E:        rmb 1
003F ??          CONFIG_3F:      rmb 1

Soon I'll start posting the full disassembly for the curious in the files area, but right now I'm moving so fast that it would be wildly out-of-date at any moment.