What does the affected system's bootloader pass in r2? If it's nonzero,
ARM's 2.6.23 may interpret it as being an ATAGS pointer. And when that
happens, the system prefers the ATAGS over CONFIG_CMDLINE.
There's sanity checking in __vet_atags, but maybe it isn't enough.
Other than that, I can't see anything yet.