The clue staring me in the face here is that the spytask starts but when control goes back to the Canon firmware, it detects the locked SD card and stops (normal behaviour for the camera when it sees a locked card and CHDK is not running).
So I need to wade through the code and figure out why it is not disabling the detection of the locked card. I seem to remember it ties in through kbd.c so microfunguy could be right about disabling the keyboard task being the exact wrong thing to do while debugging this.