I had started sprinkling printfs through the code but other calls on my time came along before I reached any conclusion. The stage I had got to was different results coming back from the CMD controller when polled in mscp_waitstep() in dev/mscp/mscp_subr.c.
Netbooting I saw:
[ 1.0000000] ubasearch: calling config_probe
[ 1.0000000] udamatch: tries=0, mi_iot=80335a78, mi_iph=8afeb468
[ 1.0000000] udamatch: mscp_waitstep 1
[ 1.0000000] mscp_waitstep: read_val=00000800, result=00000800, status=1
Booting from disk I saw:
[ 1.0000000] ubasearch: calling config_probe
[ 1.0000000] udamatch: tries=0, mi_iot=80335a78, mi_iph=8afeb468
[ 1.0000000] udamatch: mscp_waitstep 1
[ 1.0000000] mscp_waitstep: read_val=00000000, result=00000800, status=0
The all-zeros read value leads to the board not being recognised but I've got no idea why that only happens with disk boot.