Had a problem like that on the pi. Only it was putting the faked time info into the RTC insteadbof the other way around. I never did track it down. What I ended up doing was renaming the hwclock executable to something else and writing a wrapper that disallowed all write options but let everything else through.