At reset, you should see the CPU writing #$00, #$01, #$00 to $3804 to reset the ARM CPU. You can basically ignore that for all it's worth for now. $3804 needs to return d7 set.
You should then see it write #$f1 to $3802. If it's not doing that, then we are hitting a CPU emulation bug in MESS.
In which case ... how insane would it be to hook the MESS ARM core into bsnes? As I assume the bsnes CPU core into MESS would be even harder
Apologies but I'm about to sleep for tonight, have to get up in a few hours for work, and I'll be on then.