I looked over your bios.prn file excerpt and wondered how you could be
having problems.  You're doing it all just like it's supposed to be done.
I'll use my bios to work through the calculations.  Z3LOC run with the Z 
option will give addresses of the ZCPR packages AFTER you get the entire 
system loaded.	So you won't be able to get this display yet...  I'm 
including it so we can confirm the math.
  
A0:SYSTEM>Z3LOC Z
Z3LOC  Version 1.0
ZCPR3 Element	Base Address
-------------	------------
    CCP 	   BE00 H
    BDOS	   C606 H
    BIOS	   D400 H
  
Env Descriptor	   FB76 H
  
Pack: FCP	   F976 H
      IOP	   0000 H
      RCP	   F176 H
  
Buf: Cmd Line	   FE6A H
     Ext FCB	   FD46 H
     Ext Path	   F16A H
     Ext Stk	   FF32 H
     Messages	   FCF6 H
     Named Dir	   FD6A H
     Shell Stk	   FC76 H
     Wheel Byte    F175 H
  
A0:SYSTEM>
  
Early on in the bios, you should have equates something like this:
  
		;  ZCPR3 Extensions by:
		;	Jerry Furst
		;	17049 Vista Bluff
		;	San Antonio, Texas  78247	
		;	
		;********************
			IF	(H17T+H37T+H47T+H67T-1) SHR 15
		%:	NO DISK DRIVE TYPES SPECIFIED
			ENDIF
			IF	(2-(H17T+H37T+H47T+H67T)) SHR 15
		%:	TOO MANY DISK DRIVE TYPES SPECIFIED
			ENDIF
		;
		;
		;******Heath ZCPR3 equates******
		;
 0001 = 	ZCPR3	EQU	TRUE
 0001 = 	EXPATH	EQU	TRUE AND ZCPR3
	...	...	...
	code left out
	...	...	...
 00C8 = 	CLS	EQU	200
 0030 = 	EXTSTKSZ EQU	48
		;
		;******End Heath ZCPR3 equates******
		;
 0000 = 	PARTITN EQU	TRUE AND H67T
 0000 = 	H67PART2 EQU	TRUE AND PARTITN
 0000 = 	EXPER	EQU	FALSE
 0001 = 	TOD	EQU	TRUE
  
Then a little later, the following changes to the mode settings:
  
 0133 04	BIOSVER DB	VERS
 0134 A9	DEFIOB	DB	DIOB
 0135 10	PRTRDY	DB	010H
 0136 A6	MODE	DB	ZCPR3*MODEB5+PARTITN*MODEB3+MODEB1+MODEB2+ MODEB7
 0001 = 	MODEB0	EQU	00000001B		;bit 0 = 1=CRT is on H8-5
 0002 = 	MODEB1	EQU	00000010B		;bit 1 = 1=extended disk error msgs
 0004 = 	MODEB2	EQU	00000100B		;bit 2 = LPT ready polarity
							; 1=ready is High, 0=ready is Low
 0008 = 	MODEB3	EQU	00001000B		;bit 3 = 1=partitioning is used
 0010 = 	MODEB4	EQU	00010000B		;bit 4 = <unassigned>
 0020 = 	MODEB5	EQU	00100000B		;bit 5 = ZCPR3 support code enabled
 0040 = 	MODEB6	EQU	01000000B		;bit 6 = 1=run AUTO on warm boot
 0080 = 	MODEB7	EQU	10000000B		;bit 7 = 1=run AUTO on cold boot
			IF	VERS-3 AND NOT MX80
		MODE2	DB	MODE2B2+MODE2B1
  
Then we get to the pointer table, like the one you included.  Like you said,
the bios is org 0100h in the prn file and loads (in my case) at D400h, so 
the addresses should be D300h + listing address.  
The PATH is 1E6Ah + D300h = F16Ah (correct!).  The rest are done the same way.
  
		;******ZCPR3 pointer tables******
		;
		; 
 01E2 5A43505233	DB	'ZCPR3 ADDR>>>'
			IF	ZCPR3 AND EXPATH
 01EF 6A1E		DW	PATH			;Address of path table
			ENDIF
			IF	NOT(ZCPR3 AND EXPATH)
			DW	0			;Address is in ZCPR3
			ENDIF
	... ... ...
	code left out here
	... ... ...
 0203 322C		DW	EXTSTK			;Address of EXTSTK buffer
			ENDIF
			IF	NOT(ZCPR3 AND ESTACK)
			DW	0			;Stack is internal to ZCPR3
			ENDIF
		;
		;	End ZCPR3 pointer table
		;					
 0205 31C02C	WBOOT:	LXI	SP,STACK
 0208 FB		EI
  
Now, for the ZCPR initialization, we have the call on zero below:
  
 02AB 3EFF	WBT4:	MVI	A,BT$WM
 02AD F5	GOW:	PUSH	PSW
			IF	ZCPR3
 02AE A7		ANA	A
 02AF CCFE02		CZ	INICPR		;initialize ZCPR3
			ENDIF
 02B2 3EC3		MVI	A,MI$JMP
 02B4 210301		LXI	H,WBOOTE
  
And, the actual initialization code later:
  
 02F2 2A461E	CDA:	LHLD	DMAB
 02F5 B7		ORA	A
 02F6 1F		RAR
 02F7 57		MOV	D,A
 02F8 3E00		MVI	A,0
 02FA 1F		RAR
 02FB 5F		MOV	E,A
 02FC 19		DAD	D
 02FD C9		RET
		;	ZCPR3 Initialization (at cold boot)
		;
		;	Entry:	(a) = 0
		;	Exit:	None
		;	Uses:	All
		;
		INICPR:
			IF	ZCPR3 AND ZWHL
 02FE 2F		CMA
 02FF 32751E		STA	Z3WHL			;initialize wheel byte
			ENDIF
		
			IF	ZCPR3 AND EXPATH
 0302 216216		LXI	H,PATHDA		;initialize path address	
 0305 116A1E		LXI	D,PATH
 0308 010900		LXI	B,PATHSZ
 030B CDE211		CALL	MOVEIT
			ENDIF
	...	...	...
	code left out here
	...	...	...
 0374 011F00		LXI	B,EXSTKS
 0377 CDE211		CALL	MOVEIT
			ENDIF
		
 037A C9		RET
 037B 3A8F17	HOME:	LDA	HSTWRT
  
And, later you should find the data which is moved in the above code:
  
		XLT0D:	DB	1,2,19,20,37,38
			DB	3,4,21,22,39,40
			DB	5,6,23,24,41,42
			DB	7,8,25,26,43,44
			DB	9,10,27,28,45,46
			DB	11,12,29,30,47,48
			DB	13,14,31,32,49,50
			DB	15,16,33,34,51,52
			DB	17,18,35,36
			ENDIF
		;
		;	ZCPR3 Table Initialization Data
		;
			IF	ZCPR3 AND EXPATH
 1662 0100	PATHDA: DB	1,0
 1664 0000000000	DB	0,0,0,0,0,0,0
 0009 = 	PATHSZ	EQU	$-PATHDA
			ENDIF
	...	...	...
	code left out here
	...	...	...
			ENDIF
		
			IF	ZCPR3 AND Z3CLB
 1744 6E2B	CLDATA: DW	Z3CL+4
 1746 C8		DB	CLS
 1747 00		DB	0
 1748 5354415254	DB	'STARTUP '
 1750 00		DB	0
 1751 0000000000	DB	0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
 002B = 	CLSIZE	EQU	$-CLDATA
			ENDIF
		
			IF	ZCPR3 AND ESTACK
 176F 0000000000EXSTKDA: DB	0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
 001F = 	EXSTKS	EQU	$-EXSTKDA
			ENDIF
 178E 00	HSTACT	DB	0
 178F 00	HSTWRT	DB	0
 1790 00	UNACNT	DB	0
 1791 = 	HSTBUF	EQU	$
 1791 F3	CBOOT:	DI
  
  
And, finally, the actual package space:
  
 1E66		READOP: DS	1
 1E67		WRTYPE: DS	1
 1E68		DMAADR: DS	2
		;
		;	ZCPR3 Data Table Area
		;
			IF	ZCPR3 AND EXPATH
 1E6A		PATH:	DS	11
			ENDIF
	...	...	...
	code left out here
	...	...	...
			IF	ZCPR3 AND Z3CLB
 2B6A		 Z3CL:	DS	CLS
			ENDIF
		
			IF	ZCPR3 AND ESTACK
 2C32		EXTSTK: DS	EXTSTKSZ
			ENDIF
		;
		;
 2C62		HSAV:	DS	2
 2C64		RETSAV: DS	2
  
  
Now, you can use DDT to verify these addresses, also, before you install 
the new CCP.  Just type DDT at the prompt:
  
A:DDT
DDT VERS 2.2
-df100
F100 00 00 FF FF 00 00 FF FF 00 00 FF FF 00 00 FF FF ................
F110 00 00 FF FF 00 00 FF FF 00 00 FF FF 00 00 FF FF ................
F120 00 00 FF FF 00 00 FF FF 00 00 FF FF 00 00 FF FF ................
F130 00 00 FF FF 00 00 FF FF 00 00 FF FF 00 00 FF FF ................
F140 00 00 AA D4 AA D4 00 D1 28 00 00 28 00 00 29 01 ........(..(..).
F150 00 00 08 0C 00 AE D4 03 52 00 07 03 52 00 00 00 ........R...R...
F160 03 9A 00 02 00 01 01 02 80 00 01 00 00 00 00 00 ................
F170 00 00 00 FF 00 FF 00 00 00 00 00 00 00 00 00 00 ................
F180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
F190 00 00 00 00 00 00 FF FF 00 00 FF FF 00 00 FF FF ................
F1A0 00 00 FF FF 00 00 FF FF 00 00 FF FF 00 00 FF FF ................
F1B0 00 00 FF FF 00 00 FF FF 00 00 FF FF 00 00 FF FF ................
-^C
A>
  
Note that the area at 0F16Ah is filled with 01 followed by zeros as 
specified in the initialization data above.  Also, note the Command Line 
has STARTUP installed during initialization.  This is what will load the
packages you assembled and renamed SYS.RCP, SYS.ENV, etc.
  
Do the same with each address and you can confirm that the bios is set
up right and that the addresses are correct before you put them in the 
Z3BASE.LIB.
  
Looks to me like you have the procedure down pat for moving the new CCP 
into the system image and sysgen looks just fine.  When you boot next, 
you should get your signon message followed by 'STARTUP ?' like this:
  
  
 64K Heath/Zenith CP/M 2.2.04A	05/11/90
for H17 H37E DISKS  (units A thru F)
With option(s):  TOD INT BRK ZCPR3(ExWRFEShMFcNCS)
 PARALLEL DRIVER, 2/4 MHz Clock
  
  
STARTUP ?
A0>
  
If you don't get the 'STARTUP ?', maybe your Command Line is not right.  
This would also support some of the other problems you've been having, 
such as only accepting five characters, and the crazy error messages due
to passing some pointed-to-code to the BDOS as a command line.	This would
also explain different results after a power-down.  I don't know what the
problem is, but I suggest looking in this area.  By the way, you haven't 
said, but I assume the Z3HDR.LIB is pretty much unchanged.
  
Sorry about the long nights with little sleep.	Seems I tried to warn you!
Guess the challenge is there and some of us just have to accept it.
  
Talk to you when you get back.	-- ken

PS... I'll send you FSDISK and FSPRINT, (Full Screen to Disk and Full
Screen Print) via xmodem mail.n you get back.	-- ken

PS... I'll send you FSDISK and FSPRINT, (Full Screen to Dis