"fixed" the camera by copying FreeOptimusProject's camera.p970.so to camera.sniper.so.
surfaceflinger is failing like this:
8480 open("/dev/pvrsrvkm", O_RDWR) = 13
8480 fcntl64(13, F_SETFD, FD_CLOEXEC) = 0
8480 ioctl(13, 0xc01c670c, 0x100ff9c4) = 0
8480 ioctl(13, 0xc01c6700, 0x100ff89c) = -1 EFAULT (Bad address)
8480 writev(4, [{"\6", 1}, {"FramebufferNativeWindow\0", 24}, {"couldn't open framebuffer HAL (N"..., 47}], 3) = 72
Obviously /dev/pvrsrvkm exists and is accessible, as the first ioctl succeeds. So I'm trying to figure out why the second ioctl is failing.
Also note that when the phone boots, the screen is funky. It has three little cyanogenmod cid logos side-by-side at the top of the screen, in purple. They take no more than 1/8 of the screen, the rest is black.
So something is obviously wrong with my display setup....