This is going to qualify as a DDH (damn dirty hack), but what else am I good at? ;)
If you guys are at all familiar with the Tivo, they don't make the unit hackable on purpose. In fact, you have to go to an awful lot of trouble in order to be able to play with the thing at all! You have to kill the initrd process at boot time, and have to load a kernel other than theirs….however the unit will ONLY boot theirs.
The solution to this is something called monte. monte allows you to switch kernels entirely after the boot process has loaded the kernel initially.
You could in theory compile monte to execute on the linux you got to load, and then monte to your pfSense kernel, could you not? Assembler isn't my strong point here, so feel free to jump in and stomp on me if I've entirely missed the problem.
Here's the sourceforge link:
http://sourceforge.net/projects/monte/