Yeah - reading the source code of QEMU I found the structure of the NVRAM -
EVEN BETTER there was a WEB page with a good description of the various NVRAMs on Sun machines up to Ultra1. Yes, there "was". FORTUNATELY via archive.org, that page can be accessed - Tadaaaaaaaa- here it is: https://web.archive.org/web/20151107014449/http://www.squirrel.com/squirrel/sun-nvram-hostid.faq.html HOT: As I suspected: The first byte of the hostID in some systems defines the machine type. PERFECT: There are also commands given to read/write the NVRAM from the firmware. Thanks Ethan, the hint to check the emulation was great!