And that's fixed. My linker script had some padding added inside, rather than outside, the symbols I was using to determine bounds of TCM so start code was copying padding over to where the functions were supposed to be.
I now have the IPv4 checksum function happily executing out of ITCM and will play around later to try and get a bunch of the hot code moved in there.