In the Intel 8051, when a movx is used to access external RAM, the P2 port supplies the upper 8 bits of the address. When the dptr is used, all 16 bits come from the dptr. In this model, P2 comes out separately, and the upper 8 address bits were all 0's on movx accesses. I changed the memory interface block to use the P2 value instead. My simulation is working better now. Seems there are some other bugs. Maybe I haven't hit them yet...