Hello Bru,
Have a look at AN1831 (Rev 3), where the code for the ROM routine RDVRRNG makes a call to PUTBYTE. I think I have also read that the H:X register value is preserved by PUTBYTE.
I have not yet done so myself, but it may not be too onorous to disassemble this code, using an actual device, to find out how the routine works.
Regards,
Mac