Spare bytes between the seen-image flags and the turn-based event flags at Flag_TurnBasedEventState. Handler_DisplayRoomImage advances HL only while the image index is at least 08, and there are 0D images, so the pointer stays inside Table_RoomImagesAlreadySeen.