My line level converter works! Woohoo! (It turns out that it helps if you look at the *right* diagram on the datasheet, make sure that you correctly work out which wire of the cable is connected to which pin, and generally don't do a bunch of really embarassing stuff. On the plus side, it turns out that MAX232 chips are much more robust than I thought.)
What's more, pblq has now turned into a reasonably generalised mechanism for communicating with PBL, complete with the ability to suck down data using one-byte checksum packets. Currently it's running at 9600 baud, which means it maxes out at 16 bytes per second --- that's a bit over an hour to download PBL, and six *days* for the main flash --- so I've only downloaded fragments. Here's a log; do the checksums match your boards?
$ ./pblq Attempting handshake... Connected. PBL V3.1 build 1277 Maximum packet length is 8208 Checksum of 00000000+10000: 00A828D0 Checksum of 80010000+550000: 349F8B09 Downloadng: ################
$ objdump -D -b binary -m arm7tdmi output.img
output.img: file format binary
Disassembly of section .data:
0000000000000000 <.data>: 0: ea000054 b 0x158 4: ea000055 b 0x160 8: ea00005e b 0x188 c: ea000054 b 0x164 10: ea000054 b 0x168 14: 00000000 andeq r0, r0, r0 18: ea001eb2 b 0x7ae8 1c: ea001e86 b 0x7a3c 20: 00000000 andeq r0, r0, r0 24: 00007740 andeq r7, r0, r0, asr #14 ...etc...
I'll get it doing a bit more, polish the interface a bit --- in order to change options, you have to recompile it, which isn't good --- and post it somewhere in a couple of days, if people think it would be useful...