Ah, corruption displayed as PEN 2... therefore bit 1
After CLS you are peeking into the Pixels of the "R" of the Readypromt at Location 1,1
To point the CRTC to &4000:
out &bc00,12:out &bd00,16
Quick n Dirty, because the Interpreter still thinks the Screen is at &c000. With out &bd00,48 you can switch back to &c000.