The plot thickens.
I need to be able to get data out of the front panel MCU (e.g. to know if it's in DFU or application mode, or if a flash block was successfully erased/written).
But PB4 is NJTRST / SPI1_MISO is my only way to do that, and due to an errata if I ever configure it in any alt mode other than 0 (NJTRST) the JTAG TAP resets.
Current workaround is to configure it in JTAG mode except when actively executing a readback operation, at which point I change it back to SPI mode.
This isn't working and I'm not yet sure why. Hopefully implementation bug somewhere in the chain of hardware.