Is it possible to exploit this glitch for arbitrary code execution?

No. A key part of ACE is that the sprite overflow comes from the flute revealing a staircase. Even if you reach the sprite limit with these duplicated armoses, when you try to walk into the one on the right to reveal the staircase, nothing will happen and the game won’t let the staircase spawn. I’m also not sure if these duped armoses work towards the sprite limit, I never tried to see if they stop spawning. So that’s another reason it won’t work.

This can be seen in the graveyard too - max out the ghinis and try to open the grave to the magical sword - the grave won’t move.

ACE works because the flute staircase in the graveyard in 2nd Quest on FDS doesn’t have a check to see if the sprite limit is reached. That’s what gives you the ability to overflow it and get ACE.

I don't understand why it doesn't cause overflow. if the sprite limit is e.g. 11, spawning the 11th armos on the right (in the video) will reveal a staircase. isn't the staircase the overflow? i couldn't find any evidence of overflow in searching.

Because ACE is much more complex than that and the game is smarter than that. ACE involves more than just a sprite overflow, but more than that, the game protects against ACE.

I had it backwards in my initial post because I hadn’t messed with it in so long - in the graveyard with the magical sword in First Quest, you can only spawn 9 additional ghinis instead of 10 because the game reserves the 11th sprite for the staircase. The same thing would happen here - you could max out the sprite limit minus 1 because the game reserves one spot for the staircase.

Even in FDS 1.0/1.1 the game does this. The one exception is for the staircase revealed via flute. That staircase isn’t reserved in the FDS version, thus the overflow can occur (along with all the other factors you need).

Thank goodness we don't have some stupid ACE on NES so we don't get another rash of folks claiming Any% WR ATTEMPTS.

timmiluvs, looks like your conclusion is correct, but the reasoning is not correct. the memory address for the ladder (or anything under an armos) is not in the enemy sprite addresses (~0350ish). however, the whistle activation or bombable wall is in those addresses.