Just so I don't forget, there are a couple more places in the dtoa.c that look suspicious and need to be checked;  I haven't tried to generate failures for them yet.  Since we're up to bug 5, I'll number these 6 and 7:

(6) at the end of bigcomp, when applying the round-to-even rule for halfway cases, the lsb of rv is checked.  This looks wrong if bc->scale is nonzero.

(7) In the main strtod correction loop, after computing delta and i, there's a block:

                bc.nd = nd;
                i = -1; /* Discarded digits make delta smaller. */

This logic seems invalid if all the discarded digits are zero.  (This is the same logic error as is causing bug5:  the bigcomp comparison code also assumes incorrectly that digit nd-1 of s0 is nonzero.)