AT command interface works! The cause of the breakage was the same Nucleus API issue with NU_Create_Timer() which we encountered at the very beginning of this project with Riviera timers: the code in uartfax.c from TCS211 was passing 0 as the initial dummy value for the timer duration, and our FreeNucleus version doesn't like it. The fix is the same: pass 1 as the initial dummy value instead.

# XRAM image loadable into Openmoko modems for ETM/MokoFFS R/W operations,
# no GSM functionality.  The ETM/RVT serial channel is steered to the
# headset jack - use with the external debug cable.

target	gtamodem
feature	mokoffs rw
feature	etm
feature	tmffs2

RVTMUX_UART_port=IrDA