AT command interface works! The cause of the breakage was the same Nucleus API issue with NU_Create_Timer() which we encountered at the very beginning of this project with Riviera timers: the code in uartfax.c from TCS211 was passing 0 as the initial dummy value for the timer duration, and our FreeNucleus version doesn't like it. The fix is the same: pass 1 as the initial dummy value instead.

/*
 * The exit-mode and flash settings in the hardware parameter files
 * specified with -h or -H are meaningful only for fc-loadtool, but
 * the same hwparam.c code is included in fc-iram and fc-xram as well.
 * This module provides the stubs, allowing fc-iram and fc-xram to link.
 */

void
set_default_exit_mode()
{
}

void
set_flash_device()
{
}

void
set_boot_reflash_hack()
{
}