I had a chance to look at the code this morning: bug confirmed.
The bug was exactly what I thought it was, i.e. the CloneVDI compaction feature has a function which checks unpartitioned areas of the disk (useful if the user has deleted or shrunk a partition), and that function had an implicit and incorrect assumption that slot 1 in the MBR would always be used to define the first partition. The bug only arises if compaction is enabled, and that assumption is wrong, and the actual first partition begins 1MB or more into the disk.
I'll do a bugfix release soon.