I'm going with info from here:
http://www.snes9x.com/forum/topic.asp?TOPIC_ID=7293
Yet below it states that reading $213b,$213c,$213d update the PPU2 latch.STAT78 (Version 2.0)
Bit 5 ------ Complement Bit 5 of last value read from $2138,$213c,$213d.
I tested the latches by a ton of random $213b,$213c,$213d reads with random values in CGRAM.
I noticed that the top 7 bits of reads from $213c/$213d (when reading the top bit of the latch counters) do in fact get updated from any reads from $213b-$213d.
Ok, great. I tried getting STAT78 right next. First thing I noticed is that $213b reads modify bit 5 of STAT78. Second, it doesn't appear to be the complement, but the direct value, at least on my SNES (2/1/3 NTSC region 0).
lda $213b ;A=#$FF
lda $213f ;A=#$23
lda $213b ;A=#$00
lda $213f ;A=#$03
---
$2138 reads do not affect $213c/$213d/$213f reads in any way I can see. Default PPU2 latch value at reset seems to be #$ff. Hard to tell, I can only notice this by reading $213f immediately at reset (giving me only bit 5). Could be that the latch value isn't updated at reset and the copier did something that made bit 5 get set.
$2137 reads always give me #$00. This could be because my copier screws up the CPU open bus. Should this just return the CPU MDR like $43xc-$43xe? I'd think all the PPU regs would be special cased.
...back to testing...