AT command interface works! The cause of the breakage was the same Nucleus API issue with NU_Create_Timer() which we encountered at the very beginning of this project with Riviera timers: the code in uartfax.c from TCS211 was passing 0 as the initial dummy value for the timer duration, and our FreeNucleus version doesn't like it. The fix is the same: pass 1 as the initial dummy value instead.

#include "types.h"

void
cmd_dieid()
{
	u32 addr;

	for (addr = 0xFFFEF010; addr <= 0xFFFEF016; addr += 2)
		printf("%08X: %04X\n", addr, *(volatile u16 *)addr);
}