I'll try, but the solution is not straightforward.
Previously covered in replies #120 and #239.
Edit: confirmed the dm-spy-experiments branch is not working, even with minimal logging options (dm_spy_extra* commented out).
Need to use a long jump for patching DebugMsg. It started to work - to some extent - with this:
int err = patch_instruction(DebugMsg_addr, MEM(DebugMsg_addr), FAR_CALL_INSTR, "dm-spy: log all DebugMsg calls");
err |= patch_instruction(DebugMsg_addr + 4, MEM(DebugMsg_addr + 4), &my_DebugMsg, "dm-spy: log all DebugMsg calls");
The semaphore error appears to come from beep() - somebody's calling that before beep_init. Disabled beeps, it went further.
When trying to save the log, it fails with:
[dm-spy] captured 128kB of messages
[NotifyBox] Pretty-printing... (128kB)
[ CtrlSrv:fe49c7fc ] (83:02) DlgShootOlc.c LOCAL_DIALOG_REFRESH
qemu: fatal: Trying to execute code outside RAM or ROM at 0x87274218
That was because I've patched two instructions from DebugMsg, to implement the long call, but when uninstalling the logging hook, I should have "unpatched" both instructions. Rookie mistake.
Now, the hard part - clean up the code and commit it

Still need to find a general solution for patching arbitrary functions in Canon code (i.e. to implement long jump support in the patch manager).