The fire buttons on the joystick are mapped to digital joystick 0's fire 0 and fire 1.
6807h seems to be a temporary register. It is readable. It seems to reflect the value of the current analogue channel being read. At other times it reflects the values seen by unmapped registers (last byte on the bus). This register needs to be tested further to examine exactly when the analogue joystick values appear and when unmapped data appears.
===PAL subcarrier locking===