Super. And of course I completely forgot to get a savearea dump before we fixed it -- could have been useful in having Hijack automatically detect/fix this kind of thing in the future.
Silly me.

Actually, the old (bad) settings are probably still in flash (it takes 32 suspend/poweroff cycles on average before they get wiped). But it's not really worth the fuss.
The visual autorepeat settings are saved as a bunch of 2-bit bitfields in the flash, and I suspect accidental sign-extension is happening to one of them when the field next door isn't all zeros. Or something like that.
Cheers