I looked at this some more last night.
Here is the rebuilt mr. do file I'm using:
Checking segments in T:\test\Mr. Do (FLAT).exe
Header marker 0xFFFF at 0x0000
Valid segment [0x0009 - 0x0009] at 0x0002
Valid segment [0x0244 - 0x0244] at 0x0007
Valid segment [0x0100 - 0x0114] at 0x000C
Valid segment [0x0700 - 0x3FFF] at 0x0025
Valid segment [0x4800 - 0x4AFF] at 0x3929
Valid segment [0x5B00 - 0xB97F] at 0x3C2D
Valid segment [0x02E0 - 0x02E1] at 0x9AB1
Segment sets RUN address of 0x0700
It appears the the actual loading process is locking up when it tries to load the 5b00-b97F segment, but only on real hardware.
When loading from the emulator the code works perfectly.
I'm still not sure whats causing the bug, but I figured I would share in case someone else has seen this. More eyes could probably help since I dont see anything actually wrong with the loader.