AT command interface works! The cause of the breakage was the same Nucleus API issue with NU_Create_Timer() which we encountered at the very beginning of this project with Riviera timers: the code in uartfax.c from TCS211 was passing 0 as the initial dummy value for the timer duration, and our FreeNucleus version doesn't like it. The fix is the same: pass 1 as the initial dummy value instead.

/* this header file defines the data structures for the SREC reader module */

struct srecreader {
	char		*filename;
	FILE		*openfile;
	int		lineno;
	u_char		record[256];	/* binary */
	char		record_type;	/* ASCII char */
	u_char		datalen;
	uint32_t	addr;
};