NWR04B: ZTEXTADDR vs. The World

I followed Cyberdyne's suggestion and looked at the link options for the kernel I'm making for the NWR04B. So far, it looks promising, though I'm not that much better off. The problem was that the argument for puts, which should've been the address of some text to print to the screen, was 'way off and as a result I was seeing garbage. A closer look (with some paying attention this time) showed that, instead of being passed the address 0x28a0 (where you'd see EXMIF -- FIXME backwards), it was being passed the argument 0x428a0. And sure enough, in arch/armnommu/boot/Makefile, whaddawe see but this:

ifeq ($(CONFIG_CX84200_SMC),y)
#ZRELADDR        = 0x00040000
#ZTEXTADDR       = 0x00000000
ZRELADDR        =0x00008000
ZTEXTADDR       =0x00040000
INITRD_PHYS     =0x00700000
endif

This page told me that ZTEXTADDR is, basically, the address in memory where the kernel should expect to start -- or in this case, where the decompressor (I'm doing make zImage here) should expect to start. That sounds like something that would affect where things get put, all right, so I tried changing ZTEXTADDR to just 0x0 -- and sure enough, the argument passed to puts has the right address this time. But still no joy: when I load the image, I still don't see that EXMIF, but just a single character (which is better than the 416 characters of crap I was seeing previously) of uncertain ancestry (because for some reason the capture of serial port output to a file upon which I could run hexdump was not working). And furtherly furthermorish, that 416 characters of crap I was talking about were found in the original image starting at 0x418a0 -- an offset of 0x3F000, or off by a thousand from what I would have expected. So, like, what, memory is starting at -0x1000? Arghhh.