> Did the "bad" display start from "good" at the beginning of a session?
> Or did it start from "bad" to begin with?  If the former, the next
> idea is to put a watchpoint on the cached composition in a session
> with "good" display, and then do whatever it takes to make it "bad",
> hoping that the watchpoint will break at some point and show us the
> code which replaces nil with these [X-OFF Y-OFF WADJUST] vectors.

I think it starts from "bad" to begin with.  But the former theory could
still apply, if you do not mind this vague answer, can you provide
instructions to set a watchpoint?  If the watchpoint never triggers, we
might be able to at least rule out the former theory.