Sorry to reply to my own post, but I fixed this.
I applied the pre-2.1.5 patch, which fixed the problem in loop.c.
I patched floppy.c myself; change line 4177 from:
c = get_fs_byte(i);
to:
get_user(c,&i);
(I didn't post a real patch because I don't have an exact
copy of the original)
-- Version: 3.12 GCS/M/L d- s-:+ a--- C+++(++)>$ UL+(++)>++++$ P+++ L+++>++++$ E++ W-(--) N++ o-- K-- w--- O- M-- V-- PS+++? PE Y+ PGP-- t+* 5- X R tv--? b+>+++ DI D--- G e-(*)>++++ h r++>+++ y?