NWR04B: Oh so very close

Okay, so the solution appears to have been there all along:

CFLAGS_PIC="-msingle-pic-base -fpic"
CFLAGS="-O2 ${CFLAGS_PIC}"
LDFLAGS="-Wl,-elf2flt ${CFLAGS_PIC}"

Compile busybox with that and the HRI/Snapgear toolchain, and I get this when it boots:

IP-Config: Complete:
      device=eth0, addr=192.168.23.12, mask=255.255.255.0, gw=255.255.255.255,
     host=test, domain=, nis-domain=(none),
     bootserver=192.168.23.254, rootserver=192.168.23.254, rootpath=
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
Looking up port of RPC 100003/2 on 192.168.23.254
Looking up port of RPC 100005/1 on 192.168.23.254
VFS: Mounted root (nfs filesystem).
Freeing init memory: 48K
Using fallback suid method
init started:  BusyBox v1.00 (2005.08.27-07:03+0000) multi-call binary

...and there it hangs -- gotta get the console right. Still, this is a fuck of a lot better than the various errors I was getting. Can't believe I missed what was right in front of my face. This is with, notice, no softfloat options for GCC. The trick appears to be using -msingle-pic-base -fpic in LDFLAGS -- I'd had those earlier in CFLAGS alone, and it wasn't working then.