STM32N6570-DK: FSBL→Appli handoff hangs in Flash Boot only (DEV boot works), AP1 unreachable

[Aru-h]

Board: STM32N6570-DK. STM32CubeIDE FSBL + Appli project, Appli XIP from external flash (EXTMEM_XIP_IMAGE_OFFSET = 0x100000, EXTMEM_HEADER_OFFSET = 0x400). Appli signed with STM32_SigningTool (-align) and flashed at 0x70100000.

Symptom:
- DEV boot (debugger loads and runs): the FSBL → Appli handoff works and the application runs normally.
- Flash Boot (standalone): the FSBL prints "init done, calling BOOT_Application" and then nothing, every time. No fault handler output, no reset.

Already checked:
- JumpToApplication() disables SysTick, IRQs and both caches before setting VTOR/MSP (standard ST pattern). Under DEV boot, a valid SP/PC is read from the image.
- Removed all snprintf/newlib use from the FSBL boot path, and a print after the VTOR switch; no change.
- Offsets and signing match the extmem config.

Key observation (SWD hot plug, STM32CubeProgrammer, no reset):
- DEV boot: AP1 (Cortex-M55) reachable, core identified, memory readable.
- Flash Boot while hung: AP1 completely unreachable (core can't be identified); AP0 answers partially but no memory read completes.

Question: what in the Flash Boot path could leave the CPU/bus in a state where AP1 is unreachable after the FSBL jump — e.g. RIF/RISAF/IAC settings, XSPI memory-mapped configuration, or security attributes that differ from what the debugger sets up in DEV boot? Any known errata or required FSBL step for an XIP Appli in Flash Boot?

Detailed report attached (PDF). Also opened as support case 00269955.