To be clear, I'm talking about the actual memory cells at addresses $0000 and $0001 in the DRAM chips. Devices can of course initiate read or write requests to these address on the address/data buses to which they're connected, but that doesn't necessarily mean that this will result in an actual read from or write to the RAM device.
According to §4 of Christian Bauer's excellent VIC-II article, the CPU's data bus is tri-stated during a write access to the registers of the 6510's on-board PIO at addresses $0000 and $0001. (This is not mentioned in the 6510 data sheet.)
He says, however, that these memory locations can be written anyway though a mechanism that I don't really understand¹, involving the VIC-II actually doing the write.
He also says that, at least on some C64s, those locations in RAM can be read by the processor via reads in the $DE00 "I/O 1" area (presumably so long as a cartridge or whatever hasn't mapped some I/O devices in there) or via "sprite collisions."
So how exactly does this work? What devices (the 6510, the VIC-II, external devices you add yourself on the expansion bus, etc.) can read from and/or write to locations $0000 and $0001 in the RAM devices, and how exactly do they do it?
¹ It seems to be something to do with what goes on during φ1—the
"VIC-II's phase" of RAM access—where the VIC-II has enabled RAM for
its own purposes and
R/W̅ is low, causing a write to happen anyway.
But I don't see at all where the data come from, or why there would
not be a re-write of random data to that location during φ2, when
presumably nothing is driving the data bus. And I guess for this to
work the VIC-II needs to be programmed to be using the first 16K block
of memory? This is probably all wrong; I include this speculation just
to give you an idea of where I am in my confusion.