OK I feel a bit better. The issue I hit in 2009 is not relevant today. So it wasn't that 2009 issue.
As to the Gizmo fix, my code already says
if ($var_sep != "&") {
$PATH_INFO = array_get($_SERVER, 'PATH_INFO', '');
if (!$PATH_INFO) {
$PATH_INFO = array_get($_SERVER, 'ORIG_PATH_INFO', '');
So it does already account for ORIG_PATH_INFO. I tried changing that top line to be explicitly ORIG_PATH_INFO and it doesn't help. Turning on spider-friendly URLs still doesn't work - it redirects users to the forum homepage.
On both servers .php is mapping to php-cgi.exe in IIS. So that's identical.
I'll dig into the PHP.INI tomorrow to see if it could be something in there.