rp2350 with 0.36.1.dev15 - Error creating root component at address 0x00007000: Memory transfer fault

After #1718 has been merged, pyocd does now detect the rp2350 correctly (with my probe firmware auto-detect even works) - great!

But there is still an error message in conjunction with rp2350:

hardy@ntbox:~$ pyocd list
  #   Probe/Board                         Unique ID          Target    
-----------------------------------------------------------------------
  0   RaspberryPi YAPicoprobe CMSIS-DAP   E6614C775B1D4D35   ✔︎ rp2350  
      RaspberryPi                         Pico2                        
hardy@ntbox:~$ pyocd reset -v
0000861 I Target type is rp2350 [board]
0001084 I DP IDR = 0x4c013477 (v3 MINDP rev4) [dap]
0001089 I Root Component Class 0x9 ROM table #0 @ 0x000000 (designer=913 part=004) [rom_table]
0001093 I [0]<00002000:AHB-AP CS-600 class=9 designer=43b:Arm part=9e3 devtype=00 archid=0a17 devid=0:0:0> [rom_table]
0001096 I [1]<00004000:AHB-AP CS-600 class=9 designer=43b:Arm part=9e3 devtype=00 archid=0a17 devid=0:0:0> [rom_table]
0001097 I [2]<00006000:??? class=15 designer=43b:Arm part=193> [rom_table]
0001100 I [3]<00007000:ATB Funnel CS-600 class=9 designer=43b:Arm part=9eb devtype=12 archid=0000 devid=34:0:0> [rom_table]
0001103 I [4]<00008000:TPIU CS-600 class=9 designer=43b:Arm part=9e7 devtype=11 archid=0000 devid=20:0:0> [rom_table]
0001105 I [5]<00009000:CTI CS-600 class=9 designer=43b:Arm part=9ed devtype=14 archid=1a14 devid=1040500:0:0> [rom_table]
0001109 I AHB5-AP@0x2000 IDR = 0x34770008 (AHB5-AP var0 rev3) [discovery]
0001112 I AHB5-AP@0x4000 IDR = 0x34770008 (AHB5-AP var0 rev3) [discovery]
0001113 E Error creating root component at address 0x00007000: Memory transfer fault [discovery]
0001116 I AHB5-AP@0x2000 Class 0x1 ROM table #0 @ 0xe00ff000 (designer=43b:Arm part=4c9) [rom_table]
0001119 I [0]<e000e000:SCS M33 class=9 designer=43b:Arm part=d21 devtype=00 archid=2a04 devid=0:0:0> [rom_table]
0001121 I [1]<e0001000:DWT M33 class=9 designer=43b:Arm part=d21 devtype=00 archid=1a02 devid=0:0:0> [rom_table]
0001124 I [2]<e0002000:BPU M33 class=9 designer=43b:Arm part=d21 devtype=00 archid=1a03 devid=0:0:0> [rom_table]
0001126 I [3]<e0000000:ITM M33 class=9 designer=43b:Arm part=d21 devtype=43 archid=1a01 devid=0:0:0> [rom_table]
0001128 I [5]<e0041000:ETM M33 class=9 designer=43b:Arm part=d21 devtype=13 archid=4a13 devid=0:0:0> [rom_table]
0001130 I [6]<e0042000:CTI M33 class=9 designer=43b:Arm part=d21 devtype=14 archid=1a14 devid=40800:0:0> [rom_table]
0001132 I AHB5-AP@0x4000 Class 0x1 ROM table #0 @ 0xe00ff000 (designer=43b:Arm part=4c9) [rom_table]
0001135 I [0]<e000e000:SCS M33 class=9 designer=43b:Arm part=d21 devtype=00 archid=2a04 devid=0:0:0> [rom_table]
0001138 I [1]<e0001000:DWT M33 class=9 designer=43b:Arm part=d21 devtype=00 archid=1a02 devid=0:0:0> [rom_table]
0001140 I [2]<e0002000:BPU M33 class=9 designer=43b:Arm part=d21 devtype=00 archid=1a03 devid=0:0:0> [rom_table]
0001142 I [3]<e0000000:ITM M33 class=9 designer=43b:Arm part=d21 devtype=43 archid=1a01 devid=0:0:0> [rom_table]
0001144 I [5]<e0041000:ETM M33 class=9 designer=43b:Arm part=d21 devtype=13 archid=4a13 devid=0:0:0> [rom_table]
0001146 I [6]<e0042000:CTI M33 class=9 designer=43b:Arm part=d21 devtype=14 archid=1a14 devid=40800:0:0> [rom_table]
0001151 I CPU core #0: Cortex-M33 r1p0, v8.0-M architecture [cortex_m]
0001151 I   Extensions: [DSP, FPU, FPU_V5, MPU, SEC] [cortex_m]
0001151 I   FPU present: FPv5-SP-D16-M [cortex_m]
0001156 I CPU core #1: Cortex-M33 r1p0, v8.0-M architecture [cortex_m]
0001156 I   Extensions: [DSP, FPU, FPU_V5, MPU, SEC] [cortex_m]
0001156 I   FPU present: FPv5-SP-D16-M [cortex_m]
0001159 I 4 hardware watchpoints [dwt]
0001160 I 8 hardware breakpoints, 1 literal comparators [fpb]
0001165 I 4 hardware watchpoints [dwt]
0001166 I 8 hardware breakpoints, 1 literal comparators [fpb]
0001171 I Performing SW reset... [reset_cmd]
0001286 I Done. [reset_cmd]

Looks like it has something to do with rom_table detection.

Any suggestion where I can start searching?

PS: of course this happens with the latest 0.36.1.dev15

Reproduce the issue with pyocd reset -v on an RP2350 using the reported 0.36.1.dev15 setup. Start by tracing the ROM table detection path mentioned in the report and the handling of the component at address 0x00007000. Done means reset completes without the memory transfer fault while the target remains correctly detected.