You are a f*cking diamond!
I've had to jtag my HOS three times because of this issue. I was about to give up after trying for the fourth time to S-Off (this time with Rumrunner). But once again I couldn't use the phone once I had re-written the secure flags.
But this seems to have worked. I can get into the CM 11 set up sequence instead of just the endless boot or a blank screen.
Just flashing my Nandroid now - Hope I'm not being premature with my thanks, but so far looking good.
Thank you! Thank you! Thank you! Thank you!
HTC One S - S-Off, oh yes!