I have tried to find the function sub_FF8218C8 but I think that was copied from another boot.c and the position has changed. I have started reading the threads you mentioned and there is a lot of help there so I'm gonna follow up on the IRQ handlers that 0x1930/34 seem to relate to.
You should be able to figure out if the 1930/34 are correct by searching for the constants in both an existing firmware (e.g. SX10) and you new one, and comparing how they are used. If you are using IDA, just search for sequence of bytes, 00001930
Or you can just try it. If it doesn't work, you know it's wrong. The other thing that could be wrong is the offset subtracted from p in taskCreateHook. You can probably find that by comparing the code as described above.
edit:
Is there a dump for this uploaded somewhere ?