diff --git a/include/CIC6105.h b/include/CIC6105.h
index 09a363a4d5..76dce8d1e3 100644
--- a/include/CIC6105.h
+++ b/include/CIC6105.h
@@ -3,6 +3,8 @@
 
 #include "ultra64.h"
 
+#include "versions.h"
+
 // IPL3 puts values in those addresses as part of the anti-piracy checks
 #define CIC_ADDRESS_1 0x002FB1F4
 #define CIC_ADDRESS_2 0x002FE1C0
@@ -15,6 +17,10 @@ void CIC6105_AddRomInfoFaultPage(void);
 void CIC6105_Destroy(void);
 void CIC6105_Init(void);
 
+#if MM_VERSION <= N64_JP_1_1
+void func_80081980_unknown(void);
+#endif
+
 extern s32 gCICAddr1Val;
 extern s32 gCICAddr2Val;
 
diff --git a/include/PR/mbi.h b/include/PR/mbi.h
index acfe89084c..011107f2ae 100644
--- a/include/PR/mbi.h
+++ b/include/PR/mbi.h
@@ -80,6 +80,7 @@
 #define M_AUDTASK   2
 #define M_VIDTASK   3
 #define M_NJPEGTASK 4
+#define M_CICTASK   4
 #define M_HVQTASK   6
 #define M_HVQMTASK  7
 
diff --git a/src/boot/CIC6105.c b/src/boot/CIC6105.c
index 73ce74dd5c..e198f8d6e4 100644
--- a/src/boot/CIC6105.c
+++ b/src/boot/CIC6105.c
@@ -2,23 +2,61 @@
 
 #include "build.h"
 #include "fault.h"
+#include "macros.h"
+#include "regs.h"
+#include "scheduler.h"
 
 #pragma increment_block_number "n64-us:200"
 
 s32 gCICAddr1Val;
 s32 gCICAddr2Val;
 FaultClient sRomInfoFaultClient;
+#if MM_VERSION <= N64_JP_1_1
+s32 gCICValue1;
+s32 gCICValue2;
+
+s32 func_80081A54_unknown(void);
+#endif
 
 void CIC6105_Noop1(void) {
+#if MM_VERSION < N64_US
+    SREG(20) = 1;
+#endif
 }
 
 void CIC6105_Noop2(void) {
+#if MM_VERSION < N64_US
+    SREG(20) = 0;
+#endif
 }
 
 void CIC6105_PrintRomInfo(void) {
+#if MM_VERSION >= N64_US
     FaultDrawer_DrawText(80, 200, "SP_STATUS %08x", IO_READ(SP_STATUS_REG));
     FaultDrawer_DrawText(40, 184, "ROM_F [Creator:%s]", gBuildCreator);
     FaultDrawer_DrawText(56, 192, "[Date:%s]", gBuildDate);
+#else
+    u32 status = IO_READ(SP_STATUS_REG);
+
+    FaultDrawer_SetCursor(0x30, 0xC8);
+    if (status & SP_STATUS_SIG7) {
+        FaultDrawer_Printf("OCARINA %08x %08x", gCICValue1, gCICValue2);
+    } else {
+        FaultDrawer_Printf("LEGEND %08x %08x", gCICValue1, gCICValue2);
+    }
+    FaultDrawer_SetCursor(0x28, 0xB8);
+    FaultDrawer_Printf("ROM_F");
+    FaultDrawer_Printf(" [Creator:%s]", gBuildCreator);
+    FaultDrawer_SetCursor(0x38, 0xC0);
+    FaultDrawer_Printf("[Date:%s]", gBuildDate);
+    FaultDrawer_SetCursor(0x60, 0x20);
+    FaultDrawer_Printf("I LOVE YOU %08x", func_80081A54_unknown());
+
+    {
+        // TODO: where to put this?
+        static const char unused[] = "flag:%08x data:%08x\n";
+    }
+#endif
 }
 
 void CIC6105_AddRomInfoFaultPage(void) {
@@ -29,6 +67,60 @@ void CIC6105_Destroy(void) {
     Fault_RemoveClient(&sRomInfoFaultClient);
 }
 
+extern Scheduler B_801F85E0_unknown;
+extern OSMesgQueue B_801F86F8_unknown;
+
+#if MM_VERSION <= N64_JP_1_1
+extern u64 cic6105TextStart[];
+
+void func_80081980_unknown(void) {
+    // TODO: do something with the hardcoded sizes
+    static OSTask D_80097AA0_unknown = {
+        M_CICTASK, // type
+        0, // flags
+        rspbootTextStart, // ucode_boot
+        0x000003E8, // ucode_boot_size
+        cic6105TextStart, // ucode
+        0x00000020, // ucode_size
+        (u64*)gBuildCreator, // ucode_data
+        0x00000008, // ucode_data_size
+        NULL, // dram_stack
+        0x00000000, // dram_stack_size
+        NULL, // output_buff
+        NULL, // output_buff_size
+        NULL, // data_ptr
+        0x00000000, // data_size
+        NULL, // yield_data_ptr
+        0x00000000, // yield_data_size
+    };
+
+    OSScTask task;
+    OSMesgQueue queue;
+    OSMesg msg[1];
+
+    osCreateMesgQueue(&queue, msg, ARRAY_COUNT(msg));
+
+    task.next = NULL;
+    task.flags = OS_SC_NEEDS_RSP;
+    task.msgQ = &queue;
+    task.msg = (OSMesg)0;
+    task.framebuffer = NULL;
+    task.list = D_80097AA0_unknown;
+    osSendMesg(&B_801F86F8_unknown, &task, OS_MESG_BLOCK);
+
+    Sched_SendNotifyMsg(&B_801F85E0_unknown);
+    osRecvMesg(&queue, NULL, OS_MESG_BLOCK);
+
+    gCICValue1 = IO_READ(SP_DMEM_START + 0xFF4);
+    gCICValue2 = IO_READ(SP_DMEM_START + 0xFFC);
+    func_80081A54_unknown();
+}
+
+s32 func_80081A54_unknown(void) {
+    return 0;
+}
+#endif
+
 void CIC6105_Init(void) {
     gCICAddr1Val = IO_READ(CIC_ADDRESS_1);
     gCICAddr2Val = IO_READ(CIC_ADDRESS_2);
diff --git a/src/code/z_jpeg.c b/src/code/z_jpeg.c
index 377080e7d2..91a9900af5 100644
--- a/src/code/z_jpeg.c
+++ b/src/code/z_jpeg.c
@@ -25,7 +25,7 @@ extern u64 njpgdspMainDataStart[];
  * Configures and schedules a JPEG decoder task and waits for it to finish.
  */
 void Jpeg_ScheduleDecoderTask(JpegContext* jpegCtx) {
-    static OSTask_t sJpegTask = {
+    static OSTask sJpegTask = {
         M_NJPEGTASK,                         // type
         0,                                   // flags
         NULL,                                // ucode_boot
@@ -54,18 +54,18 @@ void Jpeg_ScheduleDecoderTask(JpegContext* jpegCtx) {
     workBuf->taskData.qTableUPtr = &workBuf->qTableU;
     workBuf->taskData.qTableVPtr = &workBuf->qTableV;
 
-    sJpegTask.flags = 0;
-    sJpegTask.ucode_boot = SysUcode_GetUCodeBoot();
-    sJpegTask.ucode_boot_size = SysUcode_GetUCodeBootSize();
-    sJpegTask.yield_data_ptr = (u64*)&workBuf->yieldData;
-    sJpegTask.data_ptr = (u64*)&workBuf->taskData;
+    sJpegTask.t.flags = 0;
+    sJpegTask.t.ucode_boot = SysUcode_GetUCodeBoot();
+    sJpegTask.t.ucode_boot_size = SysUcode_GetUCodeBootSize();
+    sJpegTask.t.yield_data_ptr = (u64*)&workBuf->yieldData;
+    sJpegTask.t.data_ptr = (u64*)&workBuf->taskData;
 
     jpegCtx->scTask.next = NULL;
     jpegCtx->scTask.flags = OS_SC_NEEDS_RSP;
     jpegCtx->scTask.msgQ = &jpegCtx->mq;
     jpegCtx->scTask.msg = NULL;
     jpegCtx->scTask.framebuffer = NULL;
-    jpegCtx->scTask.list.t = sJpegTask;
+    jpegCtx->scTask.list = sJpegTask;
 
     osSendMesg(&gScheduler.cmdQueue, (OSMesg*)&jpegCtx->scTask, OS_MESG_BLOCK);
     Sched_SendNotifyMsg(&gScheduler); // osScKickEntryMsg
diff --git a/tools/disasm/n64-jp-1.1/variables.txt b/tools/disasm/n64-jp-1.1/variables.txt
index 7ae8402e4c..9ba4de0598 100644
--- a/tools/disasm/n64-jp-1.1/variables.txt
+++ b/tools/disasm/n64-jp-1.1/variables.txt
@@ -385,7 +385,9 @@ sYaz0CurSize = 0x8009D968; // size:0x4
 sYaz0MaxPtr = 0x8009D96C; // size:0x4
 gCICAddr1Val = 0x8009D970; // size:0x4
 gCICAddr2Val = 0x8009D974; // size:0x4
-sRomInfoFaultClient = 0x8009D978; // size:0x18
+sRomInfoFaultClient = 0x8009D978; // size:0x10
+gCICValue1 = 0x8009D988; // size:0x4
+gCICValue2 = 0x8009D98C; // size:0x4
 sFaultInstance = 0x8009D990; // size:0x4
 sFaultTimeTotal = 0x8009D994; // type:f32 size:0x4
 sFaultCustomOptions = 0x8009D998; // size:0x4
diff --git a/tools/disasm/n64-us/variables.txt b/tools/disasm/n64-us/variables.txt
index 47753be005..8dcd9407bd 100644
--- a/tools/disasm/n64-us/variables.txt
+++ b/tools/disasm/n64-us/variables.txt
@@ -110,7 +110,7 @@ sYaz0MaxPtr = 0x8009BE1C; // size:0x4
 gYaz0DecompressDstEnd = 0x8009BE20; // size:0x4
 gCICAddr1Val = 0x8009BE30; // size:0x4
 gCICAddr2Val = 0x8009BE34; // size:0x4
-sRomInfoFaultClient = 0x8009BE38; // size:0x18
+sRomInfoFaultClient = 0x8009BE38; // size:0x10
 sFaultInstance = 0x8009BE50; // size:0x4
 sFaultTimeTotal = 0x8009BE54; // size:0x4
 sFaultCustomOptions = 0x8009BE58; // size:0x4