Okay so just quickly the answers in case somebody will later stumble upon this:
1. reset value of SP is 7. As PUSH involves pre-increment, this means that by default stack starts at address 8. This is the same memory region as register bank 1, so if somebody does not use the register banks, and the stack remains below the bit-addressable area (i.e. uses max.24 bytes), this may be a suitable value; otherwise it's wise to change it to some higher address right at the beginning of the program.

2. reset value of accumulator is 0. This was a surprise for me, I did not expect the accumulator has a defined value after reset. I doubt anybody would rely on this reset value.

3. registers are in fact RAM positions, which are not changed across reset, i.e. after powerup they have undefined value and after "hot" reset (with no power drop) they retain their old value. Again, this is fully valid for the "biblical" original 8051, there are derivatives which may run a code upon reset (e.g. bootloader) which in turn can change certain RAM locations, including the registers.

4. RLC A/RRC A; DA A; explicit writes and read-modify-writes into PSW through its direct data address, 0D0h (for which often a "PSW" symbol is defined in various assemblers)

5. using its direct data address 0E0h (i.e. DJNZ 0E0h, jump_address); usually an "ACC" symbol is defined for this address, so DJNZ ACC, jump_address is the usual form

6. division by zero, i.e. B was 0 before DIV AB

7. result > 255, i.e. B is > 0 after MUL AB (not a very useful feature, but this is what it does)

8. ADD A, 99h; DA A. The point is, that DA A does not work after SUBB (and of course not after DEC).

9. +127 -128 but beware, this is counted not from the address where SJMP itself sits but from the following instruction's address! As SJMP is 2 bytes long, this in fact means that the range is +129 -126. In the example, it's from 0x11B6 for displacement 0x80, till 0x12B5 for displacement 0x7F.

10. AJMP jumps wherever within a 2kB segment i.e. to addresses which have the same upper 5 bits than the address from which we jump - but again counted from the NEXT instruction's address. In this example, as the next instruction starts at address 0x1001, the jump range is 0x1000-0x17FF.

AJMP/ACALL is an unfortunate legacy from the 8048, which did not have more code memory. In '51 which always has significantly more code memory it is almost unusable, as the relative range of jumps depends on exact position of the AJMP/ACALL instruction, and at the corner cases it may be only jump forward or only jump back. It is therefore for example impossible to use it in a binary library (where it's not sure where will it end up), and it makes it also very hard for the optimizing assemblers which can replace the "universal" JMP pseudoinstruction by SJMP/AJMP/LJMP as it fits, to generate proper code expecially at the "corner" cases when the jump falls close to the 2k segment boundaries.

As AJMP/ACALL occupy 16 out of the precious 256 opcodes space, I wonder whether there is any '51 derivative around which replaces them with something more useful (perhaps through a compatibility switch).

11. No. As soon as P0 is used as the lower address for external memory access (MOVX, MOVC or fetch from the external memory range), the mcu writes 0FFh into the P0 output latch, overwriting whatever value the user wrote there previously.

12. Only with great care, i.e. it may be a bad idea. The reason is that ALE pulses are skipped when MOVX is performed.

Jan Waclawek