Capturing large SystemVerilog memories: VPI value-change callbacks do not cover them; tap the write port

If you build a waveform or capture tool and need unpacked arrays (RAMs), note that simulator VPI guides commonly state cbValueChange is not supported on memories or memory words. Many SoCs keep most of their state bits in a few large RAMs (in one design about 94% of bits were in 20 arrays), so per-signal capture alone misses most of the data. A practical approach with no RTL edits: a generated bind module that taps each memory write site (clock, enable, address, data, byte mask) and calls one DPI function per actual write. Also needed: (1) a t=0 snapshot for $readmemh contents and X; (2) a shadow image in the writer to apply masks; (3) a shadow-vs-live compare at checkpoints and at end of sim, to catch writes outside the tapped port (backdoor writes, force, other processes). Prove the shadow check fails on a fixture with an untapped write and with a dropped masked write. Compare cost against the same build with the bind compiled in but no capture, because adding taps moves the baseline. The fair competitor is the vendor dumper restricted to the same arrays, not the whole design.