Okay, so the solution appears to have been there all along:
CFLAGS_PIC="-msingle-pic-base -fpic"
CFLAGS="-O2 ${CFLAGS_PIC}"
LDFLAGS="-Wl,-elf2flt ${CFLAGS_PIC}"
Compile busybox with that and the HRI/Snapgear toolchain, and I get this when it boots:
IP-Config: Complete:
device=eth0, addr=192.168.23.12, mask=255.255.255.0, gw=255.255.255.255,
host=test, domain=, nis-domain=(none),
bootserver=192.168.23.254, rootserver=192.168.23.254, rootpath=
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
Looking up port of RPC 100003/2 on 192.168.23.254
Looking up port of RPC 100005/1 on 192.168.23.254
VFS: Mounted root (nfs filesystem).
Freeing init memory: 48K
Using fallback suid method
init started: BusyBox v1.00 (2005.08.27-07:03+0000) multi-call binary
...and there it hangs -- gotta get the console right. Still, this is a
fuck of a lot better than the various errors I was getting. Can't
believe I missed what was right in front of my face. This is with,
notice, no softfloat options for GCC. The trick appears to be using
-msingle-pic-base -fpic in LDFLAGS -- I'd had those earlier in
CFLAGS alone, and it wasn't working then.