@Propwash
The issue is that REV_OUT is enabled in your CRC_CR configuration. When REV_OUT=1, the value you read from CRC_DR is the bit-reversed version of the actual internal CRC state. However, CRC_INIT expects the true internal state, not the bit-reversed output.
So when you write the CRC_DR value directly into CRC_INIT, you are initializing the CRC engine with a bit-reversed value instead of the real intermediate state — which is why the result doesn't match.
Fix: before writing to CRC_INIT, bit-reverse the value you read from CRC_DR to recover the true internal state. This is exactly why your brute-force search found 774cbe48 — it is the bit-reverse of 127d32ee.