[Toni Wilen]

I may have (finally) found the problem..

When AOS IDE driver gets transfer that is longer than 256 bytes, it splits it in two or more pieces (because max ATA transfer is 256 blocks). After first piece has finished, it reads IDE CHS/LBA registers, adds one to address and then writes it back as start address of second piece. (ATA spec says they contain last read/written address) So far so good but:

ATA-1 spec says:

At command completion, the Command Block Registers contain the cylinder, head, and sector number of the last sector read.

ATA-2 spec says:

This register shall be updated to reflect the media address of the error when a media access command is unsuccessfully completed.

NOTE 9 - Prior to the development of this standard, this register was updated at the end of every media access command to reflect the current media address

In other words ATA-2 or newer device does not need to update CHS/LBA address after command finishes normally, only in error situations. This will break AOS ATA driver logic, start address of second piece becomes invalid (I assume drive keeps old values unmodified, second piece of data overwrites beginning of first piece which also explains why filesystem structure corruption has never been reported, only data corruption)

NOTE: This theory is not tested! (EDIT: it is now)