[Galaxy S 5 Q&A, Help & Troubleshooting] FirebirdDE:
This post is obsolete: The problem is very likely not kernel-driver related.

I investigated a bit if the Kernel could be the problem. For this, I took the amplitude_rw kernel (based on Samsung's, but available from github) and Ktoonsez's version of the CM12 kernel . Both use the same version of the pn547 driver. The nfc-nci driver differs, but it doesn't make any difference if I copy the files over from the Samsung-based version and recompile. (The driver is disabled in the CM kernel by default anyway, I tried to enable it, of course. If I additionaly copy the related .so files from the Samsung rom that doesn't change anything either.) Continuing to investigate the differences, I noticed that the other difference is that the CM kernel has a hack that prevents the bcm2079x from being loaded on non-900P/I variants. I removed that line and noticed that the probe function of the driver did not complain that the device was missing, though from the looks of the code it would if it wasn't there. With that in mind, I tried to copy the bcm2079x firmware, configuration and .so files from a CM12 sprint build, but that didn't resolve the problem either.

More info: I've also compiled Ktoonsez's kernel with NFC_DEBUG set, and enabled the dynamic debug output for the driver. Doesn't look helpful to me, but for the sake of completeness:

<7>[ 967.651230] pn547_dev_open : 10,60
<6>[ 967.662071] pn547_dev_ioctl power on, irq=1
<6>[ 967.762268] pn547_dev_ioctl power off, irq=0
<6>[ 967.884563] pn547_dev_ioctl power on, irq=1
<6>[ 967.887970] pn547 : + w
<7>[ 967.888021] pn547_dev_write : writing 4 bytes.
<6>[ 967.889048] pn547 : - w
<7>[ 967.889159] pn547_dev_read : reading 3 bytes. irq=0
<6>[ 967.889218] pn547 : + r
<6>[ 967.889264] pn547: wait_event_interruptible : in
<6>[ 967.918905] pn547 : call
<6>[ 967.919127] pn547 : h
<6>[ 967.919655] pn547: i2c_master_recv
<7>[ 967.919741] pn547_dev_read : reading 3 bytes. irq=1
<6>[ 967.919793] pn547 : + r
<6>[ 967.920168] pn547: i2c_master_recv
<6>[ 967.921893] pn547 : + w
<7>[ 967.921938] pn547_dev_write : writing 3 bytes.
<6>[ 967.922314] pn547 : - w
<6>[ 967.922474] pn547 : call
<7>[ 967.922664] pn547_dev_read : reading 3 bytes. irq=1
<6>[ 967.922709] pn547 : + r
<6>[ 967.923138] pn547: i2c_master_recv
.. etc ..
<6>[ 998.860380] pn547: i2c_master_recv
<6>[ 998.873274] pn547_dev_ioctl power off, irq=0

During the log, I've had an NFC test application open and an NFC tag close to the device.

Last, I tried to check what's the problem with copying Samsung's files. If I use their NfcNci.adb, logcat throws

E/AndroidRuntime( 2655): FATAL EXCEPTION: main
E/AndroidRuntime( 2655): Process: com.android.nfc, PID: 2655
E/AndroidRuntime( 2655): java.lang.NoSuchMethodError: No static method isProductShip()I in class Landroid/os/Debug; or its super classes (declaration of 'android.os.Debug' appears in /system/framework/framework.jar)
E/AndroidRuntime( 2655):	at com.android.nfc.NfcService.<clinit>(NfcService.java:164)
E/AndroidRuntime( 2655):	at com.android.nfc.NfcApplication.onCreate(NfcApplication.java:61)
E/AndroidRuntime( 2655):	at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:1011)
E/AndroidRuntime( 2655):	at android.app.ActivityThread.handleBindApplication(ActivityThread.java:4553)
E/AndroidRuntime( 2655):	at android.app.ActivityThread.access$1600(ActivityThread.java:147)
E/AndroidRuntime( 2655):	at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1357)
E/AndroidRuntime( 2655):	at android.os.Handler.dispatchMessage(Handler.java:102)
E/AndroidRuntime( 2655):	at android.os.Looper.loop(Looper.java:135)
E/AndroidRuntime( 2655):	at android.app.ActivityThread.main(ActivityThread.java:5256)
E/AndroidRuntime( 2655):	at java.lang.reflect.Method.invoke(Native Method)
E/AndroidRuntime( 2655):	at java.lang.reflect.Method.invoke(Method.java:372)
E/AndroidRuntime( 2655):	at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:898)
E/AndroidRuntime( 2655):	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:693)