VRAM address register within the PPU, with annotations for write enables and data inputs for $2000/$2005/$2006 and the two T->V signals. Everything appears to be consistent with the skinny on NES scrolling.