Turns out I was wrong. The Flash EEPROM is indeed connected in 16bit mode, and there was nothing wrong with my addressing. What was wrong, was the program I wrote to turn the output b-code back into an image. For a variety of reasons it was skipping every second line (teach me to write code at 3am).

So now I have an image of the bootloader, but until I learn some ARM assembler, and figure out where its loading the kernel, there is not a lot to do with it, other than to stare at it.

Something interesting, is the way the Flash EEPROM is connected to the CPU. Only 3/4 of total space is acutally available, and only 1/2 of it is easily usable. 1/2 the EEPROM appears at the begining of the range, and repeats (along with an addition 1/4 of space) throught the address range.

On the bright side, I'm probably going to learn a bit more about the RS Media's hardware. Eventually, I will crack this bootloader, and finally be able to boot my RS Media using the newer firmware.