Axis control via ModbusTCP

I have been fighting these iX7NH drives for several days and they still won't reliably communicate via ethercat. However, they talk ModbusTCP just fine. What's the best way to control axis drives via ModbusTCP? The machine being driven is a pallet changer for a milling machine, so path accuracy doesn't matter, only endpoint repeatability. I figure it won't matter that I can't have CSP mode.

In order to make the drive move the motor, I have to:

1. Set coil 0x12 == 1 (SV_ON: This enables the drive output)
2. Specify movement speed (register 0x6034), acceleration (register 0x6036), and deceleration (0x6038)
3. Specify the target position (register 0x6025)
4. Set the control word (register 0x6001) to 0x30, then immediately to 0x20 (I tried this without linuxCNC, in Python, with no delay between the statements, and the servo system executed the move correctly)

Step 1 only has to happen once, step 2 whenever the application requires it, and steps 3/4 whenever a movement must happen.
It seems that I could use MB2HAL to create HAL pins for coil 0x12, registers 0x6034, 0x6036, 0x6038, and 0x6025, and data from LinuxCNC's motion planner would sail right through to the drives, but what about the control word register?
I have to set and then clear bit 5 whenever I want the drives to make a movement.

I am running LinuxCNC 2.9.4 from the official repository, but it seems that modbus functions 1 and 5 aren't available. (loading my partial mb2hal config file at halrun throws "[fnct_05_write_single_coil] out of range") I read that Linuxcnc 2.8 didn't support those functions, but that 2.9 should. What am I missing?