Okay, I tracked down what I did, which was simply to add a file "global/file-not-found.tcl", and a new configuration param under redirects.
The full instructions on a slightly nicer dirlist, plus all the files are at
http://zmbh.com/dirlist/. Download the tar file.
Note that the dirlist proc provided with OpenACS, as I tested it, would display the contents of _any_ directory which didn't have an index file (those under package www directories). My file-not-found file ensures the directory is under the actual pageroot of the server.
