The payload itself works like such:
The "kid rock" draw routine jumps into the XY rotation components of the Deku Seed
the XY rotation forms a jump into the player's name.
the player name is crafted to run a single opcode that sets the current cutscene number to the state of the $gp register (which is 0) and another jump, this time into controller input
the $gp register is special in that the game never uses it for anything
controller 1's input attempts to set the $gp register to either 0xFFF6 or 0xFFF7
controller 3's input simply sets a jump that will eventually give control back to the game
finally, since the draw function is called on multiple frames, the next update cycle will write a cutscene number 0xFFF6/0xFFF7
with the cutscene number set, a cutscene plays. In the RTA route, the last cutscene that was played is going to be the title screen cutscene, which forces Link's position to be out of bounds, forcing a void out
finally, you respawn into the the credits
