Trying to dump CCE War in the Gulf, CHR bus issues

So I'm trying to dump the CCE version of War in the Gulf for someone, but I've run into a snag that has me stumped. 128K PRG / 128K CHR. The mapper chip (TC-112) operation is simple enough, 4 registers as so:

$6000 Load 4K CHR bank to PPU $0000. Lower 2 bits unused (wr bank# << 2).
$6001 Load 2K CHR bank to PPU $1000. Lowest bit unused (wr bank# << 1).
$6002 Load 2K CHR bank to PPU $1800. Lowest bit unused (wr bank# << 1).
$6003 Load 8K PRG bank to $8000

$A000,$C000,$E000 are fixed to the last 3 PRG banks

Mirroring is hard-wired to vertical.

Now for the problem: When trying to read the CHR data, I'm getting some sort of bus interference that mangles the results (random bytes) and it will also "miss" various 256-byte pages of CHR (reads 00 in the areas). The pages it misses seems to be consistent between dumps, but there is no discernible pattern to which pages it misses.

You can even see the corruption in the CopyNES tile viewer, and each time you refresh, the tiles will glitch a little different.

The CHR ROM itself gets 12 degrees F hotter than other chips on the board during operation.

The CHR ROM used is the rather uncommon 28-pin 128K chip with only 1 /CE pin. There is an 74LS00 chip in place to deal with the CHR /RD line, albeit it deals with it kinda strange (from what I've seen). It uses 3 outta 4 NAND gates wired like this:

74LS00

pin 1 (1A): cart CHR /RD line, and pin 5 (2B)
pin 2 (1B): NC
pin 3 (1Y): pin 4 (2A)
pin 4 (2A): pin 3 (1Y), also connected to a 561 ceramic cap to GND
pin 5 (2B): pin 1 (1A) [cart CHR /RD]
pin 6 (2Y): pin 9 (3A), pin 10 (3B)

pin 8 (3Y): to TC-112


Voltage levels going thru this mess:

While the game is playing normally (graphics look good):
cart CHR /RD -> 2.33V -> LS00 -> 0.55V -> TC-112 -> 2.80V -> CHR ROM /CE

While NES is idle (CopyNES slave mode, graphics are off):
cart CHR /RD -> 0.05V -> LS00 -> 4.40V -> TC-112 -> 4.97V -> CHR ROM /CE

While reading CHR ROM (graphics are messed):
cart CHR /RD -> 4.69V -> LS00 -> 0.19V -> TC-112 -> 0.00V -> CHR ROM /CE

I don't have a great understanding of electronics at this level, so I'm unsure of why the voltages differ from when the game is running and when I'm trying to read it. I'm fairly certain this is related to my problem because I sent the plugin I wrote to someone with the Gluk version of War in the Gulf, which uses a normal 32-pin CHR and doesn't have the LS00 and the plugin works just fine for him with no CHR bus issues. The PRG ROM is the same between carts. The CHR probably is too, but I haven't resorted to pulling the ROM to read it manually yet.

Any one have any ideas? I looked thru the game code, nothing jumped at me, but if anyone wants to take a look, PM me and I'll send you the code.