On FreeDOS kernel 2040, ioctl (INT 21, AX=440D) subfunctions CH=08/48 CL=41/61 address the sector relative to the beginning of the filesystem/partition.
On MS-DOS 6.22 the same functions address the sector relative to the beginning of the device, so that head=0 cylinder=0 sector=0 refers to the MBR.
What exposed this, SysLinux (Memdisk)?
The latest stable kernel is 2041. While I doubt it will help, you could also consider trying to reproduce this bug with that.
http://sourceforge.net/projects/freedos/files/Kernel/2041/
If you want to try latest unreleased kernel, check here (and also consider emailing him directly):
https://github.com/PerditionC/fdkernel
If you want a recent binary snapshot (and don't want to build your own with OpenWatcom), try here:
http://www.fdos.org/kernel/testing/git/
Bug is confirmed in FD kernel, working on a fix.
I still need to do further testing and potential simplification/cleanup but a fixed version is now available for further testing.
http://www.fdos.org/kernel/testing/git/KERNEL.SYS
with changes from source on Github in http://www.fdos.org/kernel/testing/git/absread.diff
This was, indeed, exposed by the Syslinux installer, in particular the -m option (write MBR).
Once this is fixed, it would be great to know if there is a way to detect the faulty FreeDOS versions so we can print an error message rather than overwriting someone's filesystem, or apply a workaround if one exists.
Int 0x21 function 0x30 get DOS version, if BH=0xFD and BL < 42 then will use partition relative reads/writes (faulty versions).