Using git blame, all of the code (cbfstool & commonlib headers) was last modified 2015 and 2017, so figure it is toolchain and/or my host, which is Ubuntu 16.04.
No, the code it's choking on was actually added in April: https://review.coreboot.org/32027
I think I cherry-picked and modified a very old CL from 2015 (where I had already tried doing that once and gave up at some point) as a starting point to develop that patch, and it seems like the authoring date from that stuck around in Git, so it looks like it's from 2015 in blame. Somewhat unfortunate but can't fix it now. (Really, I'm surprised that git-blame it uses that date at all, rather than the commit date, but that's on Git.)
Someone already reported the GCC incompatibility on that patch, it requires at least GCC 6.3.0 (possibly works with 5.0 as well, don't think anybody tested that). Since the last Ubuntu LTS that comes with an older version is already out-of-support and other distros have presumably likewise been at a newer version for a while, we decided that it doesn't need fixing.
Can you deal with it locally (e.g. manually install the GCC package from 17.04)?