I decided to open a separate thread for discussing various (not yet known) unused RAM.
I found a candidate while browsing through a RAM dump of a relatively recent (DryOS r54) camera. The area where the DryOS kernel is copied seems to have a pre-determined size. The kernel occupies less than 1/3 of that area, the rest appears to be untouched during operation.
For the ixus150, the area begins at 0x6b1000 and is 0x40000 bytes long. The kernel occupies 0x6b1000 ... 0x6c1403, the rest could be used freely if my suspicion is correct. I placed the CHDK core there in current test builds, it doesn't behave any worse than at its default place.
(The port currently has a severe issue that corrupts some firmware variables The resulting asserts are the same, regardless of the location of CHDK core)The sx280 appears to have a lot more of these unused "rest" areas, but I haven't been forced to explore them yet (current features of that port don't need additional memory).
