If sping reports "unexpected result 0xc1" that's a bad sign
It basically means that although the low-level bootrom noticed you knocking and accepted the serial payload, it refused to run it because it thinks the bootloader has started. But if the bootloader was still active you'd see more characters after the 0xc1, so that means the bootloader has passed control to the baseband and the baseband has spun out of control.
The boot sequence is bootrom->bootloader<->baseband. The bootrom sanity checks the bootloader before running it, the bootloader sanity checks the baseband before running it. The sanity check is pretty weak though. If the bootloader passes CPU control to the baseband and the baseband is corrupted and throws an invalid instruction or data alignment exception (for example) early in the boot process, the exception vectors are not set up yet and you'll end up in tight loop using dummy handlers.
In other words, your S-Gold is doing bootrom->bootloader->baseband->tight loop. The tight loop is preventing the bootloader from servicing interactive bootloader requests done by bbupdater, bootneuter, and the rest.
In theory, if your baseband is empty at the right locations above a0040000, you may still be able to do the A17 hardware hack, which will trick the bootrom into thinking the bootloader is empty and so it would execute your serial payloads.