That's a really good find. I hope it will solve some of the mysterious crashes.
I really don't know where the "9" words came from. All earlier DryOS disassemblies I've looked at show 10 words of allocated stack space: S5IS (r20), SX100 (r23), A470 (r23)...
Btw. I get this for man localtime (on Linux):
The return value points to a statically allocated struct which might be overwritten by subsequent calls to any of the date and time functions.
This particular Canon function is something like localtime_r(), which is supposed to be thread-safe (according to the POSIX manual).