I'm currently struggling through this test and the errors I'm getting don't make sense, I think because I'm actually doing something wrong with VRAM address when rendering is enabled midscanline, but currently I'm not sure what.
The test enables rendering part way into scanline 0, the test would be more isolated / testing only read 2007 behavior if it was enabled in vblank.
Also as an aside it looks like there is an error in the logic to shift the results by one, as the compare has no effect here:
LDA $502
CMP #$C0 ; Address $502 is correct, but $504 wasn't, then we were off by one. Just fix that real quick...
Thanks for the continued NES testing.