So if "special" bit 1 isn't set, then there isn't supposed to be a word sized count before the MIDI data?
Correct. Luckily most trackers write both the "special" flag and the length=0 field, but early versions of Schism Tracker and (as reported here) old versions of unmo3 don't conform to that. For old versions of Schism Tracker, it's best to check if any of the parapointers would point into the edit history data and if that's true, ignore it. For detecting old versions of UNMO3, I use this code...
// Another non-conforming application is unmo3 < v184.108.40.206, which doesn't set the special bit
// at all, but still writes the two edit history length bytes (zeroes)...
else if(dwMemPos + 2 < dwMemLength && pifh->highlight_major == 0 && pifh->highlight_minor == 0 && pifh->cmwt == 0x0214 && pifh->cwtv == 0x0214 && pifh->reserved == 0 && (pifh->special & (0x02|0x04)) == 0)
const size_t nflt = LittleEndianW(*((uint16*)(lpStream + dwMemPos)));
if(nflt == 0)
dwMemPos += 2;
... which works because UNMO3 always sets the flag now.