Hi Toshi,
I don't doubt your experience or skill. I just wish to make the statements below to help clarification.
I personally don't share the same view that MTCR instruction definition is a defect or bug with the documentation. The MTCR and MFCR instructions have nothing to do with the protection scheme it is simply a Core MOV instruction. The CPU ENDINIT is only one part of the many protection schemes used with AURIX (TriCore). With AURIX (TriCore) whenever you intend to make a write access to an SFR you must look up in the manual what are the access rights. The Register Access Modes describe the rights, and I would agree there is manual bug for the TC22/3 user's manuals as this section is missing however it is in the TC27x and TC29x user's manuals.
Here is a partial list Core SFR's and it states BIV needs the CPU ENDINIT protection to be open SYSCON needs the Safety ENDINIT to be open and the PSW doesn't' require either.of these protections.
Attachment 4520
Access Terms (partial list)
Attachment 4521
ASCLIN SFR's (partial list)
Attachment 4522
Best regards
-Chris