On further testing, I think the GP fault is related to the mmio issue. Under the dynamic core and Win95 OSR2 at 256 colors, along with reversion of mmio code for case3, the S3 PCI driver allows the opening of the dos box window. However, the S3 Trio 32/64 driver leads to missing GUI elements in this exact same case -- very likely an issue related to the original way of resetting of the mmio at the "A0" location.
If setting color depth at 16 bit and reverting the commit 3974, then both drivers (1998 versions) open the dos box without issue.
However, the "segment limit emulation" (normal core) from dosbox-x corrects the issue for the S3 Trio 32/64 driver at 256 color depth, and this suggests that the GP fault and mmio issue are related. This emulation also allows commit 3974 to work without issue, too; although the dynamic core is not yet compatible with the segment limit emulation nor the commit 3974 in this example, and so reversion of this commit and use of the S3 PCI driver may be preferred for additional compatibility with the Win95 GUI at 256 color depth.