Loading zones are special collision triangles. All the collision triangles for the current scene are kept in an array called polyList[], which is only updated upon scene load.
Each triangle is 16 bytes, or 8 halfwords.
The properties of the surface are called the triangle's surfaceType, which is an 8-byte value. Some examples are whether the triangle blocks Epona, is hookshotable, or is a slippery slope.
The property that distinguishes a regular triangle from a loading zone is called the "scene exit list index", which is a 5-bit value. It is extracted by bitwise ANDing the third byte of the surfaceType with 0x1F. If the scene exit list index is 0, then the triangle is a regular triangle. Otherwise, it will be a loading zone. This allows loading zones to load up to 31 distinct entrances per scene.
The entrance that gets loaded by the loading zone depends on the scene the loading zone is in. Each scene has a "scene exit list", but even the largest scenes have fewer than 31 exits. This means you could get non-trivial wrong warps if you could set a large enough scene exit list index. A spreadsheet of the first 31 warps for each scene is provided here.
There are two ways currently known to manipulate the scene exit list index.
The first method was discovered in 2020 as an application of SRM. Some actors that warp the player do so by using the scene's exit list, so they contain a scene exit list index somewhere in their instance. Further information is provided on the dedicated ZSR page about this technique.
Some actors such as chests and owl statues have their own collision triangles. These actors are called DynaPoly Actors or dynas for short. If you load too many dyna collision triangles (such as by duping a room containing dynas in a black loading hallway), it can overflow into the data structures that immediately follow it in memory. The most useful effect of this is that it causes the game to look for the scene's collision triangles in different places than it's designed to. This means that the exit list index for a triangle could easily be large enough to overflow the scene's exit list, thereby giving a wrong warp.
Code exists in both OoT and MM to immediately crash the game if such an overflow occurs. In retail builds of OoT, this code is unused, leading to the Ganonfloor wrong warp.
Unfortunately, in MM, this code is used. This means the game will immediately crash on N64 when such an overflow occurs. GCN, WiiVC, WiiUVC, and NSO avoid this initial crash due to emulation inaccuracies but will crash when you leave the scene due to some buggy fault-processing code that runs during the scene cleanup process.