And this morning it works - and I struggled to see what I had done differently. I moved the parameter block so that it was next to the target RAM so I could put them both on the same screen-shot for you. Was it something to do with memory alignment?
No - I put R1 (result pointer) twenty bytes higher than R0 (data pointer), and now it works.
So the statement in the manual "The user can reuse the command table for result by passing the same pointer in registers R0 and R1" is false. If I do that, the IAP call fails. R1 and R0 must be different.
Also, the command sequence
LDR R3,=0x03200000
LDR R0,[R3]
really DOES read correctly from the EEPROM.
I can also confirm that the RAM address must be an absolute address, and the EEPROM address must be a relative address (relative to the start of the EEPROM block). Otherwise status code 0x0E is returned, a status code which is not listed in Table 511.
I think perhaps you need to speak to the people who wrote the manual!