While searching for something else, I found a method that seems to allow manipulating the "custom white balance" data.
The current procedure is not the most user friendly: the data can be read and written back, but writing the data doesn't affect the current session, it will only become active after switching the camera off and on again.
I found an API (yet another one) that allows storing and retrieving of various sized (pre-defined) data in flash. I have not been able to found a name for the functions, the only thing known is that they are located in "property.c" of the Canon source.
I decided calling them get_flash_property and set_flash_property.
Using set_flash_property does not immediately write to flash, it just changes the runtime copy of the data which will be stored in flash ROM during regular shutdown.
get_flash_property(int ID, char *buffer, int size)
set_flash_property(int ID, char *buffer, int size)
The number of these "properties" is camera (generation) dependent, but much lower than the number of the well known property cases or params.
This API seems to exist on all cameras, even the S1IS. "ID" is char* on ixus30 and ixus40.
The custom white balance property's name is "WB_ONEPUSHINFO" on ixus30/40. For the a3200, the ID is 2, size is 0x40.
Setting the property has no effect on the session's white balance data, it's apparently stored elsewhere.
This may not be the ultimate way to set custom white balance but it gives a new starting point for further research.
A patch is attached in case anybody is curious about the function addresses. Current method only locates them on DryOS, starting with the late r31 generation.
I probably don't have to mention that messing up these properties is an easy way to brick a camera.