I spent last night probing my 3B2/310's hard disk controller with a logic analyzer so I can see exactly how it behaves, both with and without a hard disk attached to the system. It proved to be very tricky to get the logic analyzer probes attached because the motherboard is so incredibly dense. In fact, I couldn't get a probe attached to the chip select line no matter how hard I tried. There just wasn't any room to fit a probe between the chip and a nearby resistor array, so I resorted to using a little piece of wire to just touch against the pin. I could have used three hands for that operation.
I exported the data from Saleae Logic as a CSV file, and wrote a little Python script to parse the commands out of it. This is what I got:
9.900982380000000: WRITE COMMAND 01 AUX:RESET 9.911167480000000: READ STATUS 00 9.911178980000001: WRITE COMMAND 02 AUX:CLBUF 9.911183380000001: WRITE COMMAND 08 AUX:CLCE 9.911200480000000: WRITE DATA 18 9.911219280000001: WRITE DATA f2 9.911238080000000: WRITE DATA 00 9.911257080000000: WRITE DATA 03 9.911275880000000: WRITE DATA 11 9.911294680000001: WRITE DATA 0d 9.911313780000000: WRITE DATA 00 9.911332600000000: WRITE DATA 80 9.911344700000001: WRITE COMMAND 20 Specify - 0 9.911358000000000: READ STATUS 80 9.921528400000000: READ STATUS 40 9.921534400000001: READ STATUS 40 9.921559100000000: READ STATUS 40 9.921565600000001: READ STATUS 40 9.921588800000000: WRITE COMMAND 08 AUX:CLCE 9.921663300000001: READ STATUS 00 9.921674800000000: WRITE COMMAND 02 AUX:CLBUF 9.921679200000000: WRITE COMMAND 08 AUX:CLCE 9.921689600000001: WRITE COMMAND 30 Sense Unit Status - 0 9.921702900000000: READ STATUS 80 ...
I can now match this sequence up exactly with my simulator, so I can simulate the precise behavior, including the delay between status 0x80 (which means "I'm busy, try again later") and 0x40 (which means "I'm done now")
Unfortunately, the simulator still hangs after loading and executing /etc/init from the boot floppy, but now at least I know it has nothing to do with a badly behaving disk controller. I have proof that mine behaves the same way as the real thing.