Frustrating as I found some of it, I'd like to thank you all for
your feedback.  You've convinced me.

While I still feel that the workaround is the behavior most working
sysadmins would want if they gave it two minutes thought, I now
agree that it needs to be an option, not the default.  

I now intend to
 -leave the default behaviour alone, except to generate a more
   useful log message if a bootfile name ending in 0xff is
   encountered
 -implement the workaround as an option, logging it when the option
   is invoked
 -document the workaround and its reasons in the man page

---Alex