ROM qsort () function is broken so it has been fixed to use the RAM qsort () in both cases.

c/sort

@@ -61,8 +61,10 @@ void *bsearch(const void *key, const void *base,
     }
 }
 
-
-#ifndef UROM
+/* must not use Shellsort - it is broken (subtracts potentially large
+   offsets from pointers before comparing with base, can wrap) */
+/* #ifndef UROM */
+#if 1
 /* Qsort is implemented using an explicit stack rather than C recursion  */
 /* See Sedgewick (Algorithms, Addison Wesley, 1983) for discussion.      */
 
@@ -263,6 +265,8 @@ void qsort(void *base, size_t nmemb, size_t size,
     }
 }
 #else
+/* this is broken - see comments at top of #if */
+
 /* For ROM version we use Shellsort instead of Quicksort for a saving of 880
  * bytes. This Shellsort has proven worst case < N^1.5, empirically it is
  * much better. Typical average case is either N(LOG(N)^2) or N^1.25.
@@ -302,7 +306,7 @@ void qsort(void *base, size_t nmemb, size_t size,
                         pi += 4;
                         do {
                             *(int *)p1 = *(int *)p2;
-                            p1 -= hsize;
+                            p1 -= hsize; /* one of the broken bits */
                             p2 -= hsize;
                         } while (p2 >= pj);
                         *(int *)pj = t;