I triggered my problem by booting the G1X_100g SD card on my SX260_101a. Can you predict what would happen from subs.entry.S?
G1x and sx260 have different diskboot encodings, (7 and 8 respectively) so if the wrong diskboot is present, the canon firmware will load it, decode it with the wrong key, and attempt to execute the resulting garbage.
Since this all happens in the canon firmware, there is absolutely no way CHDK could prevent it.
Figuring out specifically what would happen would require duplicating the decode process and disassembling the resulting junk, but I'd expect it to hit an exception very quickly. If the exception handlers are also borked, it could end up in an infinite loop of exceptions. I would not expect this to be very dangerous, because it should fail very quickly. Poldy's scenario is potentially more dangerous, because it can run for a while and send wrong values to real functions.
The power button or play button had no visible effect with the G1X SD card in the SX260. I took the card out and still got no response. Taking the battery out and reinserting (without a SD card) then worked
This is what usually happens when you try to run a diskboot with the wrong encoding. The camera gets stuck in a state that requires the battery to be removed to reset. Collectively, CHDK developers have done this a LOT without any obvious permanent damage.
I remember the power button becoming unreliable for awhile, and then it stopped working complete (bricked camera) no matter what I did.
That sounds like a regular old hardware failure to me. It's hard to see how executing garbage code could cause a progressive failure like that.