Now what I need is some kind soul to volunteer to answer some questions
so I can start fixing unexelf to work correctly.  Said person could begin
by answering some questions about the .sbss section is, since its existence
is the root cause of exexelf's current failure.

Mips compiler toolchains (and the mips ABI) dedicate a CPU register,
$gp, to point to a `pool' of small constants and/or small .bss values.
(it's kinda like a constant pool, except some of them are variables).

Since MIPS cpus cant load a 32-bit address directly, it's relatively
expesnive to load a 32-bit address: it's synthesised from a two insns,
a load-immmediate (low 16 bits) and a load-upper-immediate (high 16 bits);
followed by a load instruction using the 32-bit address.

Values within a 32k window on either side of the $gp register can be
loaded directly, using a 16-bit immediate offset to the $gp register.
So values within the `constant pool' are cheaper to access.

The mips compilers, assemblers, and linkers put ``small'' values
(where small is defined by the -G option, usually -G 8) into .sbss or
.sdata sections, and then the linker drops thosee into a $gp-relative
region.

The GCC man page has text which makes more sense once you know this 
background.

Actually, I'd suggest looking at the Alpha unexec code in cheaper
unexalpha.c, and seeing if it can be relatively easily tweaked to
work on a 32-bit ELF platform.