AT command interface works! The cause of the breakage was the same Nucleus API issue with NU_Create_Timer() which we encountered at the very beginning of this project with Riviera timers: the code in uartfax.c from TCS211 was passing 0 as the initial dummy value for the timer duration, and our FreeNucleus version doesn't like it. The fix is the same: pass 1 as the initial dummy value instead.

/*
 * This module is linked into pirexplore for the purpose of telling the
 * somewhat generic libmpffs exactly where the FFS is located on this
 * device and how it is structured.
 */

#include "types.h"

const u32 mpffs_base_addr = 0x02000000;
const u32 mpffs_sector_size = 0x40000;
const int mpffs_nsectors = 18;