I think that's probably true - I repeated some tests and found zeroes are in the MixBuffer also, providing the whole buffer is dumped in the same way as the audio output buffer.
However the zeroes are not arriving from the DMA stream to the dac.writePosition (which is what I tested previously, and again now). I have dumped all of those and the data looks correct.
What does look a bit strange, is the fact that dac.readPosition and dac.writePosition will depend on synchronization, and yet zeroes are being stuffed into dac.readPosition here:
case 2:
/* Crossbar->DAC sound only */
dac_LeftData = dac.buffer_left[dac.readPosition];
dac_RightData = dac.buffer_right[dac.readPosition];
dac.buffer_left[dac.readPosition] = 0;
dac.buffer_right[dac.readPosition] = 0; break;