Hurrah! I have my shiny new E3 up and running, and am getting pblq back up to speed.
It would appear that the reason pblq doesn't work on the E3 is primarily due to the NOP packet not working (it appears to cause pbl to hit an assertion and go into an infinite loop). There are also a few other gotchas that cause the handshaking procedure to go wrong. I've fixed these, mostly by copying the relevant bits of logic from pbltool --- ta.
Next thing is to try and get the flash code up and running; but I'm a little hesitant to play because I don't want to overwrite anything crucial and brick the device. *Is* there anything crucial in the NAND flash? I notice that the MTD partition table has a chunk marked 'Amstrad Block'. Does it matter if I overwrite this? Plus, am I right in that the e3's NAND flash pseudoaddress is 0x400000, instead of the e2's 0x8001000?
I've also got Jonathon's prebuilt kernel running, which appears to work nicely --- at least, it produces a palette-mangled penguin and vast numbers of error messages (in pink) as the JFFS driver fails miserably to find a JFFS filesystem on the flash. I need to try a filesystem on a compact flash device and see if that works. But it's definitely getting somewhere!