AT command interface works! The cause of the breakage was the same Nucleus API issue with NU_Create_Timer() which we encountered at the very beginning of this project with Riviera timers: the code in uartfax.c from TCS211 was passing 0 as the initial dummy value for the timer duration, and our FreeNucleus version doesn't like it. The fix is the same: pass 1 as the initial dummy value instead.

/*
 * Our mokoffs and pirffs wrappers exec the main tiffs binary; in order
 * to do it efficiently without execvp etc, we hard-code the pathname
 * where that binary is installed.
 */

char tiffs_prog_pathname[] = "/usr/local/bin/tiffs";