Despite poking both PRs I've still heard nothing back.

But, I have worked out how to apply the patch from an OpenVix-specific part of oe-alliance-core.

In meta-oe-alliance/meta-oe/recipes-distros/openvix I created a shellinabox-fix directory. This contains shellinabox.bbappend (which adds the patch to SRC_URI and prepends this location to the file search with FILESEXTRAPATHS - spent some time tracking down that this needed to be done, and how to do it...) and a shellinabox sub-dir containing the patch.

If I submit this as a PR for oe-alliance-core is it likely to get accepted?