Since people are doing the thing I explicitly asked them not to do: we accidentally case-analysed the timing through the tie cells that are read through that register. Changing bits 2 or 3 would cause a setup violation. For A3 we fixed the timing on bit 3 by reimplementing that part of the bus mux with an ECO cell and stealing a nearby buffer. It wasn't possible to fix bit 2 in the same way, so we can't use the value 0x4.
The same issue applies to the tie-cell-programmable IDAU watermark over the ROM, as described here in the bootrom source: https://github.com/raspberrypi/pico-bootrom-rp2350/blob/c6cdb1711f32c3e34faaebd58618a6d096dbd52e/src/main/arm/arm8_bootrom_rt0.S#L238-L264
@wren6991 OK so the Pico 2 appears to have an RT6150 buck-boost driving VDDIO, and that produces 3.3V output given at least 1.8V input. So I'd want to put a scope on the output to track the voltage when power is applied, but it can probably start quick enough?
I'm thinking about a situation where the bus the RP2350 sits on is pulled up. Obviously is the bus floats, it'll be eons before it comes out of reset and starts doing active things on the bus.