I found what caused the regression from 0.125u6 to 0.125u7. To make nbapbp work in 0.125u7, you have to modify sysreg_r in hornet.c and replace r = 0xf7 | (eeprom_read_bit() << 3); with r = 0xf7;
On my side, it helps to understand what did wrong. In conclusion, on my board, the faulty looks like to be the AT93C46 SOP serial eprom.