But the PPU does have to be in vblank for the CPU to write the palette; otherwise, glitches occur. And the PPU has to be in vblank or forced blank for the CPU to write to OAM, CHR RAM, or the nametable; otherwise, glitches occur.
In writing OAM, you write at OAMADDR once then you write at OAMDATA. In reading OAM, you write at OAMADDR once then you read at OAMDATA or OAM_DMA. Write increments the OAMADDR, read on vblank is not incremented. Was that all??? or am I missing something??? does OAM reside at PPU address $0000-$00FF????
I think there are known quirks/problems using OAMADDR and OAMDATA. It's better to use DMA. tepples or someone else might have some forum reference links to my claims.