Fixed in hg 7c794bda21fb on 2026-10-13 with a subsequent fix in hg d46847ba91a2 on 2026-10-14.

First changeset's message states:

Test case is to run serboot and enter this program:

a 100
 mov ax, 0281
 mov dx, 0
 mov cx, 1
 mov bx, cs
 add bx, 1000
 mov es, bx
 mov bx, 0
 int 13
 nop
 int3
 jmp 100
.

The patch makes this "succeed", however the buffer overflows and starts writing the last sector at offset 0000h again.