Now that I can actually get it working (by moving it up in memory), I'm going to do two things:

1. Print the stack pointer just to be 100% sure it didn't somehow end up where it's not supposed to be.

2. Fill the unused memory below the image with a pattern, and then check for that pattern in the zboot, and perhaps even in the kernel init. If that pattern is not corrupted then I can at least feel confident that it's not *writing* below it's load address.