Well I put together a little more info about ofwboot.xcf and my Rev 1 Beige
G3 (Rev B ROM). 

The output from 

0> boot enet:192.168.1.4,ofwboot.xcf -a file: 192.168.1.4,ofwboot.xcf
-aloading XCOFF
tsize=CB90 dsize=14E8 bsize 1608 entry 6C0000
SECTIONS:
text 006C0000 006C0000 0000CB90 000000E0
data 006CD000 006CD000 000014E8 0000CC70
bss  006CE4E8 006CE4E8 00001608 00000000
loading .test, done..
loading .data, done..
clearing .bss, done..
_

At this point the machine freezes solid and I have to reboot it. I've tried
setting load-base in OFW to 4000 (default), 600000, and 6C0000. I even tried
booting an ELF kernel and it actually said Loading ELF but then gave me a
default catch. Is loading ELF something that we are printing or did OFW
actually print that? There is no ELF loader listed in /packages, but this is
kind of a hybrid ROM chip

Also:

    What's the syntax for passing variables to ofwboot or putting in a
kernel name? No where is this written for OFW 2.x. I tried ofwboot.xcf -a ;
ofwboot.xcf ; netbsd.macppc ; ofwboot.xcf ; ofwboot.xcf
192.168.1.4,netbsd.macppc and a few others. None of which seem to work. It
always just freezes or ofwboot.xcf doesn't load at all.

    Does OFW use the load-base environment variable, the value compiled into
ofwboot.xcf, no one really knows, or does it depend on what OFW version?

    Can someone XCOFFify a GENERIC kernel that I could try to tftpboot?

    I still get wildly ranging results from using the same settings and same
commands. Sometimes the system will load the file and freeze within a second
or two, sometimes I'll get a few tftp timeouts, sometimes the tftp timeouts
just keep going and going without actually loading anything, sometimes the
machine DoS's my network and freezes every machine attached to it until I
reboot the Macm sometimes it'll tftpboot slowly, only one or two timeouts,
won't timeout at all, but loads slowly from the net, etc. etc.

    What SHOULD load-base and real-base be set to?

    OFW seems to still use the SystemDisk patches even though I have
use-nvramrc? set to false. I removed the nvram totally, but I still get
wildly different results every time I try something, so I can't draw any
conclusions yet.

    Can anyone authoritatively say that OpenFirmware itself resides on the
ROM SIMM or the ROM SIMM contains just the Start Manager (/AAPL,ROM) and
possibly fcodes for on board devices?


    any info would be helpful.


    Chris