I got it to work! 10000 is the address. I tried it after spotting an 0x10000 in the header for the upgrade files. The other words in there seemed related to the size and offset of the data in the upgrade file, so it looked out of place.

I now have my own kernel in place, and the player is working fine.

At first I missed an enhanced ide option in the kernel configuration which it needs to open the root device, but once that was in there it was fine.

This is fun :)