IIvx internal video is at physical location 0x60000000. At least, when I modify the page tables in macos so that, say, 0x20000000 points to it, and set the memory there, the video gets changed. Now, all I need to do is finish up my serial cable so I can start hacking the kernel.