Yeah, I'm going to take a look at all this with you guys soon. The weapon trail code may be a real boon.
Could 3006ebc9 be a RAM address? If we do a "breakpoint on write" in pSX and specify 3006EBC9 as the targeted address (IIRC, the RAM address may start with an 8 instead of a 3), the game will freeze when it loads the weapon trail data if this works like I'm expecting. I'm not sure whether to check user memory for the weapon trail value at that point or what though.
Gemini, if you're reading this, you're invited to suggest how we should proceed.