I have now demonstrated that the I2C timeout occurs in my code if the ISR isn't serviced. I therefore think that in most failure cases the IRQ is ignored. Occasionally it crashes.
I'd be glad to test your patch.
AAMOI why does pinging make this go away?