The code is here https://github.com/c10ud/CHDK/blob/master/core/shot_histogram.c
That isn't the CHDK source repository (it may be an up to date mirror or not, I don't know) The official source is at
https://trac.assembla.com/chdk/browser/trunk/core/shot_histogram.cIf you want to work with the source, I suggest checking out from
http://subversion.assembla.com/svn/chdk/trunk Ideally it should count only the active area, but I haven't completely figured out where exactly it's counting. Ideally also it should compensate for black level. If I fix that up, could I submit a patch?
You can always submit a patch. If you can clearly identify a problem and explain how your patch solves it while not making the code excessively complicated, there is a good chance we will accept it.
I'm not sure I agree that it should compensate for black level. Analyzing the masked portion of the sensor would require a camera specific definition for >100 cameras. If you just use the fixed black level defined in platform_camera.h, the script can do that just as well.
I do agree it should probably use active area. The reason it doesn't is historical: Active area was only defined for DNG support, and the shot_histogram code pre-dates that.
You may also want to look at
http://chdk.setepontos.com/index.php?topic=8997.0Btw, I have no hot pixels, is that unusual?
How have you determined that?
There are varying degrees of "hot" pixels: Stuck pixels that are always on, hot pixels with excessive dark current. The latter will show up at longer exposures. The stock firmware does a dark frame for long exposures (usually 3 seconds or more) which will also remove hot pixels.
From the factory, the camera has some list of bad pixels it knows to fix, so it wouldn't be surprising for a new camera to have no visible hot pixels, but over time more pixels will go bad.