Possible bug in IMXRT USB interface?

I’m attempting a port of PX4 fmurt1062-v1 target to a Teensy4.1 with a few sensors glued to it. I’ve got the ESP8266 wired up for WiFi along with essentially the same set of sensors as are on the CrazyFlie2.1. The only interface not yet running is USB.

Preliminary testing shows all sensors working plus I can communicate with QGC over WiFi. When I attempt calibration, QGC warns that I should use the USB interface, hence my need to step back and get the USB interface working. The USB interface is enabled, and I am able to do some simple testing at the nsh> prompt by connecting to a host machine, running a terminal emulator on that host and then issuing “echo abdedfg >/dev/ttyACM0” at the nsh> prompt.
This works consistently, so it “appeared” that I would be able to just run “mavlink start -d /dev/ttyACM0” and that would do it.

When I connect the PC running QGC, PX4 takes a hardfault every time. I spent several days digging into this, and isolated it to the USB interface. I was able to reproduce the crash running the latest NuttX (10.3.0) on Teensy4.1 by just writing a block of data to /dev/ttyACM0.
I built a version of NuttX configured with a UART console and using USB as a serial port. Then I found that this code consistently causes a hardfault:

void
fail(void)
{
    int fd;

    if ((fd = open("/dev/ttyACM0", O_RDWR | O_NOCTTY)) == -1)
        return(-1);
    if (write(fd,(uint8_t *)0x20200000,500) != 500) {
        return(-1);
    close(fd);  // Never gets here
}

I saw there were a few imxrt related fixes applied (imxrt fixes by davids5 · Pull Request #4784 · apache/incubator-nuttx · GitHub) and I made sure they were part of my build. What I also noticed was that the write doesn’t crash if the length is less than 192 (which happens to be 32*6), so I’m suspicious of a DCACHE problem still lurking.

Anyone have any thoughts?