Looks like Chris' patch did the right thing provided the dix-EventToCore patch is applied. I oversaw that record uses two different callbacks for the events (the naming is confusing for someone who's worked with input for a while) and the one for delivered events doesn't need fixing.
Checking with xnee again shows the right root window. Can you please confirm this? Chris patch wastes a lot less cpu cycles.