You are correct. I was aware on-die bootloader claimed 512 bytes of SRAM but didn't even consider it would block read access. I suppose that's just a concession to implementation simplicity as except for test probing as was the case here, doing so isn't really useful. Thanks!