Okay, after playing with it some more, it appears to be just a "sync()" issue. I've added a "sys_sync()" invocation to Hijack v120, which will get done after each FTP session finished (after you QUIT from FTP). But even without it, things are reliable enough so long as one does a readback after writing to flash.

For my own use, I have a shell script that ftp's a kernel to the empeg, reads it back again, and compares the readback to the original. Works great! Much faster than the slow serial downloads..