If anyone has any interest in this (a year and a half later), I found out what the problem was. If you somehow accidentally set the number of tape and disk drives to zero (which is not impossible to do), the firmware for the 8086 crashes in a routine that sets up the device IDs because it uses a pre-decremented counter to loop through the devices; when it pre-decrements 0, it becomes 255 and the thing runs amok through the memory. Bad news, especially because it turns out to be not very difficult to set both to zero.
There are two solutions. The first is to replace the little 9306 EEPROM on board, which will cause the board to identify it as erased/corrupt and initialize from defaults. Unfortunately, the damn thing is soldered in, so you'll have to desolder it (I put in a socket for future replacements). Also, you'll lose your serial number unless you copy it over; I don't quite recall what byte positions held that, but I can look it up if anyone's curious. If you take out the 9306 and have a ROM burner that supports it, you can also just erase it instead; my ROM burner theoretically supports it, but it turns out to have a bug in the 9306 algorithm and doesn't work. I repurposed an FPGA board to be my read-write maching.
The second solution involves fixing the ROM. As luck would have it, there is a useless five bytes of instructions in precisely the spot where it's needed (a register is loaded with what it's already loaded with, so the five bytes of instruction space are unneeded). I was able to put a quick check to determine that the number of devices was zero and if so, branch to loading the defaults. It's not perfect, but it keeps the 8086 from crashing, which essentially bricks the card, so I'll take it.
I'll try to get the patched ROMs posted somewhere; the legality is a little fuzzy, I think, but CMD was long ago absorbed by Silicon Image, and I doubt they'd be all that picky.
