There is no way to change the directory before boot.py runs, so I don't think there is a need to reset it there. Also, start_mp only runs once at the beginning, but the nature of the problem comes from cwd persisting across reloads, not from the initial conditions.

I don't see the maybe_run_list function checking for the filesystem, so I assumed that by this point it has already been checked? I don't really have a way of testing this without a filesystem.

Good point about boot.py, I wasn't thinking too clearly.

To fake not having a filesystem, temporarily add a return false; just before // try to mount the flash in filesystem_init() in supervisor/shared/filesystem.c.

When I do that, I get:

Auto-reload is off.
Running in safe mode! Not running saved code.

You are in safe mode because:
CIRCUITPY drive could not be found or created.

Press any key to enter the REPL. Use CTRL-D to reload.

No crash.

So it never gets to running the code.py that's good.

There is still the case when someone uses chdir in boot.py and the board goes into safe mode and runs the wrong safemode.py, but I think that's a self-inflicted wound?

ja pygamer is overflowing, but we don't need to fix that here.

There is still the case when someone uses chdir in boot.py and the board goes into safe mode and runs the wrong safemode.py, but I think that's a self-inflicted wound?

safemode.py is run after a hard reset, so I think that cannot happen?

Excellent.