I thought about this, but the KIM is a pretty simple
system. The only memory
 mapped device in that range (really, on the entire unit) are the RIOTs, and
 their RAM at $1780 is fine and does not echo.
 The KIM only does address decoding for 8K and echoes the rest, so the same
 fault is mapped at $2280, $4280, etc. I would think this would still suggest
 data is the problem.
 I suppose I could randomly replace the RAM and see what changes but again it
 seems weird to have a fault so neatly aligned and only in a specific range. 
With a simple step through program,
*=$0000
r=$0280
        inc w
        lda w
        sta $f9
        sta r
        sta r+1
        lda r
        sta $fb
        lda r+1
        sta $fa
        jsr $1f1f
        jsr $1f6a
        cmp #$12
        bne *-8
        jsr $1f1f
        jsr $1f6a
        cmp #$15
        bne *-5
        jmp $0000
w       .byt 0
it's actually an artifact of the monitor that the upper 6 were clear. Actually,
the stuck bit is entirely bit 2 (i.e., it goes
0 1 2 3 4 5 6 7 8 9 a b c d e f
0 1 2 3 0 1 2 3 8 9 a b 8 9 a b
and the high nybble is OK). Now that sounds more like a bad RAM chip, but why
would it be *just* those addresses? Does that sound like a plausible failure mode?
--
------------------------------------ personal: 
http://www.cameronkaiser.com/ --
  Cameron Kaiser * Floodgap Systems * 
www.floodgap.com * ckaiser(a)floodgap.com
-- God made the integers; all else is the work of Man. -- Kronecker -----------