Just out of curiiosity...I traced some signals on the controller board to the edge connector...not sure how easy it would be to add the 4MB memory extension (o;
So here is the pinout of the 100-pinn edge connector:
HP 3852A Edge Connector
1 NC
2 NC
3 NC
4 NC
5 NC
6 NC
7 NC
8 NC
9 NC
10 NC
11 NC
12 NC
13 NC
14 NC
15 GND
16 GND
17 NC
18 NC
19 NC
20 NC
21 NC
22 NC
23 GND
24 GND
25 NC
26 NC
27 NC
28 NC
29 NC
30 ???
31 NC
32 NC
33 NC
34 ???
35 GND
36 GND
37 RESET
38 NC
39 GND
40 GND
41 NC
42 NC
43 LDS
44 UDS
45 R/W
46 AS
47 GND
48 GND
49 NC
50 A1
51 A2
52 A3
53 A4
54 A5
55 A6
56 A7
57 A8
58 A9
59 A10
60 A11
61 GND
62 GND
63 A12
64 A13
65 A14
66 A15
67 A16
68 A17
69 A18
70 A19
71 A20
72 A21
73 A22
74 A23
75 GND
76 U27 1820-4147 Pin 4 (74HCT573 Octal Latch?) -> D2
77 D0
78 D1
79 D2
80 D3
81 D4
82 D5
83 D6
84 D7
85 VCC
86 VCC
87 D8
88 D9
89 D10
90 D11
91 D12
92 D13
93 D14
94 D15
95 NC
96 NC
97 NC
98 NC
99 NC
100 NC
Haven't found out yet what the missing 3 signals are doing...one going towards data bus transceivers to D2. Some assuming ti checks the presence of a card inserted, as pin 77 is connected to GND, but with a finer trace than power traces.
The other two I don't know yet...somehow DTACK is missing....and not sure yet if CLK is routed out...but must somehow...
The ROM images are available here...seems 4.22 is latest version...and I got 4.21 only *sniff (o;
http://www.dalton.ax/hp3852a/