In talking to Archeologist it seems that lack of zero-initialization could very conceivably cause the behavior you are seeing. In C++ the construction of global objects is guarded by a static variable, conceptually
int init_guard = 0;
init_fn() { if (init_guard == 0) { call constructor; init_guard = 1; }
If the guard is not properly initialized the constructor may not get called, causing subsequent initializations that depend on that object to crash.
Zero-initialization can be forced in the linker command file by adding fill = 0 to uninitialized sections containing C variables, typically .bss and .far. It would look something like:
SECTIONS
{
.bss > RAM, fill =0
.far > RAM, fill = 0
}
The --fill_value option, as you proposed (above, May 01 at 16:59), is not enough: it only supplies a default value to use for filling; it does not cause uninitialized sections to be filled.
Let's try that and see what happens.