NWR04B: What the hell am I missing?

I must really be missing something here, because I am unable to get this thing to write to flash at all. Here's what's going on in the kernel:

1. Turn off write protection; working. By that I mean that the kernel is successfully able to change a value in memory; the driver for this chip agrees with the datasheet from the HRI project that this is the bit that twiddles write protection.
2. The kernel tries to write the following mysterious values: 0xaa to 0x5555, 0x55 to 0x2aaa, and 0xa0 to 0x5555. The destination addresses (0x5555 and 0x2aaa) get mapped to the right area of memory: 0x20000000 plus the offset for mtd1 I've set up. Checking these writes show that they fail.
3. The kernel tries to write the first byte of data copied from the user request. Again, the address gets changed properly (0x20000000 + mtd1 offset). Again, the write fails.

(All this is in cx84200-flash.c, BTW.) I can think of two things...wait, three things...that might be happening:

1. There's a big change in memory mapping that happens some time after boot. Before The Change, flash begins at 0x0; after The Change, it starts at 0x20000000. I've been assuming, without much evidence, that the onboard bootloader does this flip before loading and running Linux. As ryanr suggested, it may not. In this case, I'd either need to make The Change myself, or else change the memory mappings.
2. There's some weirdness with little-endianness going on. Datasheet sez it's the 26th bit at 0x4000000 that twiddles write protection; this address is not affected by The Change. Maybe I'm simply counting bits from the wrong end...or something...arghh, this makes my head hurt. I think it's unlikely, though, that the developers would not have accounted for this.
3. Datasheet's wrong, or the chips not the same. Which'd suck.

Any other ideas, please let me know.