- Have I missed any other required changes to disable audio?
- Could the movie_status==4 && *(int*)0x85B8==1) check be preventing sub_FF05BA94 being called?
- Could the problem lie with the 0xC2E3C address?
Well, not much I can help at this point, as
Disclaimer: I've never tried this.
You can check whether 0x85b8 and 0xc2e3c are used similarly in funnel's and your firmware version (check the asm parts of movie_rec.c). If yes, then these addresses are obviously unchanged and - according to funnel - they should work. You can also check whether movie_status is correct in either ports (see stubs_min.S or stubs_entry.S).
If it still doesn't work, then reverse engineering is required - that consists of
- trying to understand what the firmware code does (assembly skills are required for this one)
- logging some data that helps understanding stuff
- perhaps watching the content of suspicious memory ranges while recording clips with and without audio (the latter means high speed video or miniature mode) - this can be done either with chdkptp and its rmem command or a memory viewer on camera
...
Note that CHDK 1.3 will lock up the camera when
- any file operation is attempted during video recording (that includes loading of scripts and modules)
- you exit ALT mode during video recording
due to a bug.