While the story makes it quite clear that it is about the RPC-4000 (because of the next address encoded in the spare bits of the LGP-30 instruction format), you

While the story makes it quite clear that it is about the RPC-4000 (because of the next address encoded in the spare bits of the LGP-30 instruction format), your ideas regarding the LGP-30 in (2) may actually work. Instruction "u", unconditional transfer (jump), is 12 (%1010) and the next instruction code is "t" (13, %1011), which is "test" (branch if AC is negative). So a program may cleverly overflow (by adding to the gap in the instruction) from an unconditional transfer into a conditional one, which is then ignored as AC is zero or positive and the program "falls through"… Similarly, we could overflow from "t" (test, conditional transfer) to "h" (store and Hold the contents of AC), but this doesn't make much sense, since we have a conditional branch instruction in place right from the beginning.