The short answer from memory:
- At the beginning of a frame the address is set to zero
- The address is incremented over a line for R0 (total chars aka horizontal timing) character access cycles.
- Only R1 (displayed characters) are visible.
- The address is reset after R0 character access cycles.
- Then the scan line counter is incremented
- When the scan line counter reaches R9 (Max Scan Line -1):
- Scan line counter is reset
- Address is incremented by R1
Rinse and repeat.