It looks like the firmware only updates parts of this overlay that actually change.
But your voltmeter script (that uses _LCDMsg_SetStr) causes flickering of all CHDK OSD elements and menu.
I filled a part of the RGBA overlay(s) using memset. The Canon OSD did not erase parts that fell outside the playback mode overlay, while browsing images. It only got overwritten when I entered the Canon menu.
I noticed in Auto mode (where the canon firmware updates the focus box all the time) leaving alt mode with the CHDK menu open sometimes results in a flashing copy of the menu. Similarly, sometimes the <alt> indicator will flash for a long time after leaving alt mode.
I managed to reproduce something similar on the M10. "Scene intelligent auto" and "hybrid auto" modes seem to be affected, but it's not easy to reproduce.
What's likely happening (IMHO) is that we are refreshing the wrong buffer (because the firmware happens to flip them while we're trying).
I could think of 2 possible workarounds:
1) try using a different active_bitmap_buffer (for example, the M10 has another very similarly acting fw variable at offset +4)
2) refresh both buffers
I tried 2) on M10 and now I don't seem to get visible glitches.
The sx280 seems to act differently, the only problem I encountered (once) so far was when I exited ALT while the Canon menu was active: upon exiting the Canon menu, the CHDK menu appeared on the fading remains of the Canon one.
A bunch of these call seemingly simple drawing functions (GrypDrawDot, GrypDrawHLine) which I hoped to call directly. However, I wasn't able to get GrypDrawHLine to do anything with various guessed arguments and sequences of Flush/Finish calls, in a loop of 50 calls with a 10ms sleep. Little surprise this didn't work since I couldn't find examples in the firmware of a correct sequence.
Yeah, that's hard. On the sx280, a very large part of these functions is unreferenced, a small subset is actually used. I also managed to crash Zico by sending two XimrExe messages in a row (the second one caused the crash).
Since D6 DSLRs use the same Xtensa firmware (I found a 750d dump somewhere), it might be possible to get some more information from their fw.
I'm assuming I can find your message logging code somewhere up this thread?
Not yet, just the hint (the point where it can be hacked). You also might need to find and disassemble the Xtensa blob(s) to get the message list.
edit:
I attached the research-hack I used on the sx280. Almost every bit of it will need to be adapted if somebody would like to use it on another camera.
