Hi Andrew,
on my x201t I got the same problems. I bisect it to cbmem console: Locate the preram console with a symbol instead of a section. (commit 35382a6e, Change-Id: I3257b981e).
@Gabe: Do you tested the commit with SeaBios as payload?
@Andrew: You can also use a raspberry pi or a beaglebone black. They are a lot faster than a buspirate (30min -> 5min).
Best, Alex
cfg: http://lynxis.crew.c-base.org/coreboot.config.762d53d41_without_cbmem