I was able to fix this by mounting the boot partition from the provided xenial sd-card image and examining their boot setup, which includes these two magic lines: fdt addr ${dtb_addr} fdt set mmc${boot_mmc} boot_device <1> "boot_device" is an undocumented (and poorly named?) DTB property. ...