Metroid Fusion - Skip to End of Game with Memory Corruption

Metroid Fusion finally has a sequence break!
To see this trick done in real time (non-TAS) for the purpose of speedrunning, see here: • Metroid Fusion - Seque...
This trick involves using memory corruption to overwrite the event value stored in save data, allowing you to skip more than a third of the game. The memory corruption is done by getting out of bounds and laying power bombs. Whenever you lay a power bomb, the game checks which blocks are affected by the power bomb explosion. It reads the block's clipdata value and changes it if necessary. Clipdata determines how Samus interacts with a block. Some examples include hatches, missile tanks, and bomb blocks. Depending on the clipdata value, the power bomb explosion might also affect the background 1 value of the block, which determines its appearance. For example, if a power bomb explosion touches a hidden speed booster block, the background 1 value will change to reveal that it's a speed booster block. For clipdata, most values are changed to 0. However, for background 1, many values are changed to 0x8000. The goal of this trick is to change the event value to 0x80 (128 in decimal). Normally, the highest event value in the game is 109.
The clipdata values for the current room start at 0x2026000 in RAM, while the background 1 values start at 0x202C000. Note that these are 0x6000 bytes apart. When a power bomb explosion touches a block, it uses the following formula to find the address of its clipdata value:
0x2026000 + ((y_position / 64) * room_width + (x_position / 64)) * 2
Background 1 uses the same formula, except with 0x202C000 instead of 0x2026000. If you go out of bounds, your X and Y position will be much higher than normal. This means that laying power bombs while out of bounds will access memory addresses that are way past the clipdata and background 1 values. In particular, save data starts at 0x2038200, which can be reached by using this trick. As it turns out, the event value for Slot C is stored at 0x203CA21, and 0x6000 bytes before this contains the blocks that have been broken in Sector 4. Whenever a block is broken that never respawns, three bytes are written to this area: the room ID, the X position of the block, and the Y position of the block.
Clipdata and background 1 values are two bytes. For this trick to work, the two-byte value at 0x2036A20 needs to be a value that the power bomb explosion will interpret as a block that needs to be revealed, thus modifying the value 0x6000 bytes away at 0x203CA20 (where the event value is stored). Since we have control over which blocks to break, we have control over what this value will be. After investigating all of the possibilities, the only value that works is 0x0D05 (which is interpreted as a screw attack block). This is obtained by first breaking 10 blocks, then breaking a block with a Y position of 0x05, then breaking a block in room 0x0D. Conveniently, there are two blocks with a Y position of 0x05 in room 0x0D, and all of these blocks can be broken during the first trip to Sector 4. Once all of these blocks are broken, the correct values will be in memory and no further setup is needed.
At some point during the game before performing the memory corruption, the game needs to be saved at least once, preferably as close to the ship as possible. Technically, the game can be saved in the ship at the very start. For this video, I saved on the Main Deck shortly before getting power bombs.
After obtaining power bombs, all that matters is getting out of bounds in a room that's wide enough (remember that room width is part of the equation for determining the address to check). Getting out of bounds involves freezing an enemy close to a ceiling corner, getting wedged in the corner, and jumping while unmorphing (the game doesn't check for ceilings if you jump while unmorphing). Once out of bounds, I navigate to 0x2038A20 and lay a power bomb, which changes the event value to 0x80. After this, I have to reload the save by dying. If I were to reset the game, the save data would be reloaded from external memory and copy over the memory corruption.
After reloading the save, the game thinks I'm in a state where the Omega Metroid is already dead. Regardless, the game always tries to spawn the Omega Metroid, since the door is supposed to lock behind you and you can't re-enter. If you allow it to spawn, you'll get softlocked because the SA-X will never show up. However, you can trick the game into triggering the Omega Metroid's death by visiting the room twice, which causes the ship to arrive. I have to go two rooms back, because only the destroyed version of the hallway leads to the destroyed version of the docking bay.
This trick is possible in real-time (it's not TAS-only), but it requires careful counting during the out of bounds portion. I know this trick is very complex and hard to explain, so I'll try to answer any questions in the comments.