Hmm, maybe I got the tap IDs wrong.
If I bridge only C227, OpenOCD sees part 0x7926, and I can reliably halt the CPU and probe the flash:
Open On-Chip Debugger
JTAG tap: feroceon.cpu tap/device found: 0x07926041 (mfg: 0x020, part: 0x7926, ver: 0x0)
JTAG Tap/device matched
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x800000d3 pc: 0x00f3aac0
MMU: disabled, D-Cache: disabled, I-Cache: enabled
> flash probe 0
Flash Manufacturer/Device: 0x00bf 0x00d6
flash 'cfi' found at 0xfffc0000
> dump_image currentcontents.bin 0xfffc0000 0x40000
dumped 262144 byte in 156.199112s
If I bridge both C227 and C228, or C228 only, OpenOCD sees only part 0x5182.