Mm.. Okay, here is the file access pattern when the player reads config.ini at startup:

HIJACK: read(config.ini): PID=9(player), pos=8192/8268, count=76
HIJACK: read(config.ini): PID=9(player), pos=0/8268, count=4096
HIJACK: read(config.ini): PID=9(player), pos=4096/8268, count=4096
HIJACK: read(config.ini): PID=9(player), pos=8192/8268, count=4096
HIJACK: read(config.ini): PID=9(player), pos=8268/8268, count=4096

The filesize in this case is 8268, "pos" is the starting offset for the read, and count is how many bytes were requested. I didn't trace lseek(), but it looks like something has done an lseek(filesize modulo 4096) before doing the first read.

It's that first read of (filesize modulo 4096) that is confusing Hijack into thinking that only the end of the file was being read. Why is the player doing that? Or is it some quirk in libc, trying to trigger a readahead of the whole file or something?

I suppose I'll have to make hijack more clever or something on this. Tricky..