Well... on my a570 I have seen it switch to a new directory before it should have (yes, it's 2000 photos normally). I believe it's always happened either during timelapse or MD use (I think, it's been quite a while). Also since file numbering can be reset, there's no way of knowing whether that's been done unless you're the first and only user of that camera. Also, if my memory doesn't fail me, there's a way to fiddle with file numbering by doing something with the file/directory names on the card (meaning it could get messed up by by accident if you use more than one SD card).
But anyway, did that params corruption of yours mess up with the vers.req accessible shot counter too? ewavr's script doesn't clear that, it only writes those three strings that you can see in the script you ran!
836 is a lot though, maybe this got corrupted with the rest of your parameters flash area?
