Found it. The instruction @ 0x0010878A should be a "bset", not a "bclr". Due to this bug, DTCE was not activated when the Cybiko tried to read a page from the serial dataflash, and got stuck in a loop.

http://home.base.be/vt6480682/h8ops.h.diff