What'd I say? What did I say?

Turns out I was clearing CY when I was clearing OV, S and Z at the start of the handler for ADD/ADC/ADDI/ADCI and SUB/SBC/SUBI/SBCI.

Man, I positively suck at bug hunting. I was even looking for exactly that kind of bug. I saw the r = sreg part and totally ignored the clear carry right below it. Glad you figured it out, at least!