This will not work correctly if telldir() did not allocate a new struct ddloc but reused an existing one. One way to fix it is to make telldir() move the reused struct ddloc to the head of the list (but that will also modify the old cookie).

yes you are correct that if the telldir cookie being seeked is not the last that was issued this will not find it, however that was a decision I made in order to keep the patch small.
In the example used by samba the action is always:
telldir();
readdir();
telldir();
readdir();
telldir();
readdir(); // oops it won't fit, put it back..
seekdir();
{work}
telldir();
readdir();

so , as I mentionned this will only allow a reliable backwards step of a single item, and assumes that the telldir we are using is the one just before the read we want to undo.
otherwise it is just as broken as it is now.. I don't pretend to fix any more than that one case. (well actually I accidentally do fix a bit more but that's a by-product.)'
Actually thinking about t a but more, if the "old cookie" in your example was followed by a "readdir" and needed to be fixed the second time, then it would have needed to have been fixed the first time too, so it would already be fixed..
(and as such would not be recognised as a match, so a duplicate would be issued..)
The fix is only ever applied if the previous cookie refers to a position beyond the end of the buffer that has just been completed. Since the data is not IN that old buffer, keeping around such a cookie seems pointless, better to make it point to the real data.