Exception 02 (0x02) — Illegal Data Address

The address, or the address plus the quantity requested, is outside the range the server implements. The function was fine; the range was not.

Start free Modbus → canonical

Diagnosis

When you hit this

Off-by-one from the 1-based documentation convention: a manual listing register 40001 means offset 0 on the wire.
Reading 125 registers starting near the top of a block, where the start address is valid but start+count runs past the end.
Assuming a contiguous map. Many controllers have holes, and a read spanning a hole fails for the whole request.

Resolution

How to fix it

Subtract the offset convention
40001 in a manual is usually offset 0 with FC03. 30001 is offset 0 with FC04. Read one register at the suspect address to isolate it.
Bisect the range
If a block read fails, halve it. The boundary where it starts failing is the real end of the implemented range.
Split reads at known holes
Issue several smaller reads that each stay inside a contiguous block instead of one wide read that spans a gap.

Normalization

What Forge does about it

A request that fails on some points and succeeds on others still normalizes. The tags that arrived resolve to canonical fields as usual; the ones that did not come back are listed in unresolved_tags and excluded from coverage_pct, so a partial read reports as partial instead of quietly looking complete.