==== TPA ====
The top address of TPA can be found by reading the byte at 0006 0007 (which is the top byte of the BDOS JP). This is the start of BDOS. CCP lives below this. If you wish to include CCP subtract &A from this.
e.g.
0005 JP &8C06
0006 0007 is &8C. So up to &8C00 can be used.
Subtract &A to include CCP. &8C-&0A = &82. So up to &8200 can be used.