On the ZX81, when the ULA that functions as the video chip is generating display output, it takes the character cell byte (that the CPU was tricked into fetching as an opcode) and combines it with an internal 3-bit counter, to generate an address to access the font in ROM and fetch a byte of bitmap.
The font is 64 characters, 512 bytes, so it should be necessary to generate nine bits of address, and sure enough, looking at the pinout https://www.sinclairzxworld.com/viewtopic.php?t=1249
We can see pins marked A0-8 (with ' marks that presumably indicate these pins generate addresses rather than reading addresses generated by the CPU?).
But hang on. The ROM is 8K. That's 13 bits of address. It's true that the upper 4 bits are constant, because the font never moves, but they still have to be placed on the address bus, or there would be no guarantee that the generated 9-bit address was referring to the correct 512-byte section of the ROM. (I'm assuming the top 3 bits of the 16-bit address don't matter once ROMCS is enabled.)
How does the ULA generate a full 13-bit address for this?