I'm running out of ideas for the issue with the dark frame subtract setting not affecting anything.
What I know is that the location of the call to capt_seq_hook_set_nr was wrong. It was in a location in capt_seq that did not normally get executed. When I fixed that, the camera would consistently crash when capt_seq_hook_set_nr was called. I traced this to the call to _time. The address for this function looks OK. When I commented that out, it doesn't crash, but changing nrflag has no effect. I tried a few possible candidates for the nrflag address, one of which seems to be the same variable used in other ports.
Then again, in a camera with such a small image sensor, most people would probably want the default Canon behavior for lower noise (i.e. the "Auto" setting).