AT command interface works! The cause of the breakage was the same Nucleus API issue with NU_Create_Timer() which we encountered at the very beginning of this project with Riviera timers: the code in uartfax.c from TCS211 was passing 0 as the initial dummy value for the timer duration, and our FreeNucleus version doesn't like it. The fix is the same: pass 1 as the initial dummy value instead.

/*
 * These functions are normally defined in the DL protocol stack entity,
 * and are called by L1S.  When building L1 standalone, we need to
 * provide stubs.
 */

void *dll_read_dcch()
{
	return(0);
}

void *dll_read_sacch()
{
	return(0);
}

void dll_dcch_downlink()
{
}