RCM4400W crash when tcp_tick() is called

I have a very simple code to make a PPP connection to an ISP over GPRS. This same code (with slight changes for CPU) works well on an RCM3000 with serial port C for the modem.

On the RCM4400W, I get as far as tcp_tick() and then I get a target has stopped responding error. I also noticed some corruption of the XMEM at the same time. I can see this by including the Zworld sample to show memory which I have hacked down to only show XMEM status.

I think something is wrong in the Zworld code during initialisation. Tech support has told me they have replicated the error but so far no fix for it. My client is breathing down my neck to get this finished but I am stuck because it lies within the Zworld software. I can debug into tcp_tick() and it fails at this function call - retval = ie->ncd->ifctl(ie->state, up, change); Line 2229

I am using my own designed carrier board. Nothing complex, only serial ports and 4 IO ports are used for IO. The modem is connected to Ser Port C, the GPS to Ser Port F (was on B but this is used to config the FPGA and I was worried the GPS output would cause errors)

Anyone else got problems with the RCM4400W?