Bit of an obvious one in hindsight but documenting it for posterity.
Only one support entry for this one (2208059.1) - and it relates to webtier upgrades and missing patch 20922780. This wasn't the issue.
The first step on the EBS tier after copying the RUN_BASE is to run adcfgclone.pl. The last question it asks is "Do you want to startup the Application Services.....". You must respond to this with "N" rather than "Y". The subsequent call to adpreclone.pl appsTier in the RUN_BASE will run fine regardless whether the services are up or not. The call to adcfgclone.pl appsTier in the PATCH_BASE after copying the RUN_BASE however will fail as it is trying to use the same SSL and HTTPD ports as the RUN_BASE (and these will be in use if the services are up in the RUN_BASE).