You are correct. I was aware on-die bootloader claimed 512 bytes of SRAM but didn't
even consider it would block read access. I suppose that's just a concession to
implementation simplicity as except for test probing as was the case here, doing so
isn't really useful. Thanks!