I just came across this thread.
I'm working on ixus85 and it had the exact same problem: 12 bit CCD RAW data and hard-to-find RAW buffer.
However, I now have everything in RAW working including DNG support. This required adding 12-bit support to the backend, and finding two (!) addresses in memory for the RAW buffers, which switches from one to another, depending on a switch somewhere else. I had the exact same 'mistake' in finding the RAW address via CrwAddress, which seems to be bogus. Also, my CCD was 3720x2772 instead of the more standard 3736x2772. (however, if you shoot in continuous mode, every OTHER shot WILL be at the CrwAddress)
What I did in the end is just dump 64MB from 0x10000000, and then just 'looked' for the data in photoshop.
The core 12-bit routines should be the same for the ixus90, and the RAW image searching is a pain but doable.
I'm attaching the DIFF for the core routines here. (svn diff include/ core/)
See the discussion on ixus85 here
http://chdk.setepontos.com/index.php/topic,2841