AT command interface works! The cause of the breakage was the same Nucleus API issue with NU_Create_Timer() which we encountered at the very beginning of this project with Riviera timers: the code in uartfax.c from TCS211 was passing 0 as the initial dummy value for the timer duration, and our FreeNucleus version doesn't like it. The fix is the same: pass 1 as the initial dummy value instead.

#include <stdarg.h>

int
sprintf(char *strdest, char *fmt, ...)
{
	va_list ap;
	char *strptr;
	int len;

	strptr = strdest;
	va_start(ap, fmt);
	len = _doprnt(fmt, ap, &strptr);
	va_end(ap);
	*strptr = '\0';
	return(len);
}