Thanks for answering, Andrey.
I tried setting debug=all after the linux command and got maybe half a screen worth of output before hanging. I lack the hardware to attach a serial or network terminal device and capture the whole thing, but here are the last few lines (copied by hand):
script/script.c:50: malloc 0xc366e120
script/script.c:50: malloc 0xc366e0e0
script/lexer.c:321: token 0 text []
script/script.c:50: malloc 0xc366e260
script/script.c:50: malloc 0xc366e220
script/script.c:65: free 0xc366e220
script/script.c:65: free 0xc366e260
script/script.c:65: free 0xc366e0e0
script/script.c:65: free 0xc366e120
The output before what I copied was of the same form as what you see above, i.e. mallocs, frees, or "token X as text []." There were probably around 30 lines in total. As far as I could tell, all of the mallocs had an associated free and vice versa.
I guess the Linux boot parameters are somewhat outside the scope of this list, but I also tried adding "debug" and "initcall_debug" to the linux command line, and this did not produce any additional output prior to the hang.