Running d10 in no shoot mode, with the 10ms sleep and buffered log has hit the error twice in less than an hour, after 1600 cycles.
So this seems like a valid and probably quicker way of finding out if a camera is affected by the bug.
For anyone who is interested, the attached patch is a minimal workaround to ignore the bug and log it to the script console. I haven't verified it, but the logic is the same as my debugging patch, with a slightly tighter restriction on the bad value. The patch is against the trunk, but it should apply to pretty much any chdk version.