Memory disclosure via SDP timing oracle

Information disclosure in NXP i.MX and Vybrid boot ROM allows physically proximate attackers to read memory through the SDP port. When SDP_READ_DISABLE blocks direct reads but leaves SDP enabled, timed WRITE_DCD commands invoke CHECK_DATA and expose each tested bit through USB response latency. The attack requires physical access to an SDP interface and repeated resets on closed HABv4 devices; it discloses DDR contents or memory-mapped fuse data without modifying them.