Hello Nigel
The following are only guesses, but they might help if you're running out of ideas:
(1) The Master Privilege Register (MPR) and Peripheral Access Control Registers (PACRn) can be configured to enable/disable reads and writes from various bus masters (e.g. DMA) to various periherals (e.g. UART).
Maybe these are set in such a way that they are causing the problem?
The MPR and PACRn are part of the System Control Module.
(2) In the DMA TCD, have you got the DOFF field in TCD word 5 set to a non-zero value? If so, the destination address will increment after the first transfer, so the second transfer might be to a 'rogue' address.
Good luck
Simon