Finally handling BD+ (?)

Some success.
These are the first entries of the plain conversion table as it comes from the vm memory:

<---- ????? ----> <----  A ----> <---- A' ---->
b6 be 74 2b 32 c7 94 d0 bc cc b2 72 76 b8 af 89  
73 84 14 69 fc ee 88 0a 8a ae 33 41 f8 50 02 ad  
ac 84 f4 00 e2 47 38 0e 56 3e a1 49 0b 82 39 21 
a2 84 04 1e 5c 35 de f6 6a e1 0f bc 92 5d 3a cd

I have calculated the corresponding B and B' for the first segment:

B  = 3EFDFC42F8
B' = 3F99F3C46C

You can verify that:

0x94d0bcccb2 XOR B  = 0xAA2D408E4A
0x7276b8af89 XOR B' = 0x4DEF4B6BE5
0x880a8aae33 XOR B  = 0xB6F776ECCB
0x41f85002ad XOR B' = 0x7E61A3C6C1
...

Each of the 5 bytes overwrite a "bad spot" as you can see from posting #13.