I'm going to be pulling the chip fairly soon. Life took over for a bit. If it doesn't contravene any laws or ethics or something, I will post a copy of the raw contents of the flash when I've got it off.
I looked at the data sheet and it doesn't have a boot block like many of the flash chips I'm used to dealing with. So, I'm presuming it picks some arbitratry spot to load and execute.
If I can find that point then we're cruisin' to happy town.
I had another thought. I wonder if these units share a bios with other units that do support 48bit. If they do, perhaps they check some value stored in an eeprom during post and disable things accordingly, and its a matter of disabling those routines?
Another thought that runs through my head is with the size of the eeprom being limited, perhaps the best route would be is to find the location of the "boot block" that it loads and executes after post and just stuff Grub on there. I'd imagine its all gravy after that point.
Rambling over
Cheers