So far, it seems that I am running up against two problems:

1) OF_read() (called from hfs_read()) is failing to read the text
segment of the kernel off my hfs partition. My plan is to try
reading a kernel off a non-hfs partition, to rule out some kind of
bug in the hfs handler. 

2) After typing in a kernel name, and getting the 'read text' error,
I get an 'Invalid memory access' exception.  This is why I am being
dumped back out into openfirmware.  %srr0 shows that ofwboot.xcf
is in __syncicache() trying to execute the 'dcbst' (data cache block
store) instruction.  I'm puzzled as to how I got all the way into
__syncicache() if loadfile() failed, so it is possible that it is
trying to dcbst an invalid address.

-Brian