EVAL-ADTF3175D-NXZ: cannot re-flash ADSD3500 firmware after a 4.1.5 downgrade — "burst transfer failed" on every write tool (chicken-and-egg)

Summary

On an EVAL-ADTF3175D-NXZ kit, the ADSD3500 firmware was downgraded to 4.1.5. After moving the SOM to the v6.1.0 SD image (SDK 6.1.0, commit 847bd8bd), I can no longer flash the firmware up to 5.2.5
(Fw_Update_6.0.0.bin). Every firmware-write path fails, and the kernel driver reports "Read/Write burst transfer failed". Read-only access still works, so the board is alive and I have a full NVM backup. I need the
correct recovery procedure (or a full flash image) to get the module back to a working firmware.

Hardware / Software environment

- Kit: EVAL-ADTF3175D-NXZ (NXP i.MX8MPlus SOM + ADTF3175D module: ADSD3100 + ADSD3500)
- SD image: microsd-v6.1.0 (Ubuntu 20.04.6, kernel 5.10.72-adi)
- SDK: ToF 6.1.0, commit 847bd8bd
- ADSD3500 firmware (current): 4.1.5 (downgraded; chip ID reads 0x5931)
- Target firmware: 5.2.5 (Fw_Update_6.0.0.bin, 97792 bytes)
- ADSD3500 I2C: bus 1, addr 0x38

Background (how it reached 4.1.5)

The module originally shipped with firmware 4.2.0.0, which initialized and communicated normally. During earlier debugging it was downgraded to 4.1.5 by flashing Fw_Update_4.1.5.bin. We do NOT have a full flash
backup of the original 4.2.0.0 image (the on-board /boot/ADTF3175D.nvm turned out to be identical to the current 4.1.5 contents — verified with cmp).

Symptom — the key diagnostic

The kernel driver fails all burst transfers to the ADSD3500:
adsd3500 1-0038: Read burst transfer failed
adsd3500 1-0038: Write burst transfer failed

fw_upgrade (built from tools/nvm_tools/fw_upgrade) gets through reset, burst-mode switch, and the update command, but fails at the very first packet write (v4l2_ctrl_set(fd, 0x009819e1, ...)):
Size of Binary: 97792
Resetting the ADSD3500: ~7s.
Reset done.
send_switch_to_burst_mode_command; SUCCESS
send_get_firmware_version_command: Failed to set ctrl with id 9968097
FAIL
send_init_update_commands: Update firmware command; SUCCESS
Packets Needed: 382
Packet number: 1 / 382 Failed to set ctrl with id 9968097

What I have tried (all fail with the same root cause)

- data_collect --ip --fw Fw_Update_6.0.0.bin (host, network via aditof-server 0.0.0.0:5556): Connects fine, but camera init fails — "camera_itof.cpp:161] Unkown imager type: 0" then "main.cpp:328] Could not
initialize camera!". 4.1.5 does not support the 0x0032 imager-type query, so init never reaches the FW-write stage. No init-bypass option in --help.
- Firmware_Update Fw_Update_6.0.0.bin (on-target): "Switched to burst mode" then "Reading Adsd3500: Input/output error" then "Current firmware version is : 0.0.0.0" then "Writing... Packet 1/382: Input/output error".
- fw_upgrade (on-target, with reset_adsd3500()): reset + burst + update command all SUCCEED; the first packet write fails ("Failed to set ctrl 0x009819e1").
- NVM_WRITE (on-target): Same write path (v4l2_ctrl_set 0x009819e1) gives the same failure.
- host_boot.sh (BootROM, host_boot.py over raw I2C): RAM boot-FW load succeeds ("CHIP_ID is correct ... 0x5931"), but the subsequent "modprobe adsd3500" cannot talk to the chip — "Read of Chip ID register failed",
"Chip ID: FFFF8000 is wrong", "Could not set mode register". So subdev-based tools cannot run in host-boot mode.
- Web-UI flash_firmware.sh (gunicorn :8000): It is just a wrapper around Firmware_Update, so the same failure.
- Stop network-gadget / reload driver / clean reboot: No effect — the root cause is the burst incompatibility, not resource contention.

What still works

NVM_READ (standard-mode read, not burst) completes successfully — it reads all 362 packets and produces a valid 741376-byte full-flash image. So I2C / chip ID / standard-mode read are all healthy, and I have a full
backup of the current (4.1.5) flash plus /boot/ADTF3175D.ccb. It appears that 4.1.5 responds to standard-mode reads but not to burst-mode transfers, which the v6.1.0 driver/tools require for any firmware write.

Questions

1. Is there a full flash image (.nvm / .bin) for a known-good firmware (4.2.0.0 or 5.2.5) that I can write back via NVM_WRITE, including the correct ADSD3100 calibration layout?
2. What is the official recovery procedure when burst transfers fail like this? In particular, is there a way to write the NVM in host_boot (BootROM) mode over raw I2C, independent of the kernel driver and burst
mode?
3. The firmware upgrade wiki says "If the version number has not updated please check the NXP based option to update the firmware." — where is that "NXP based option" documented?
 4. Is the "Read/Write burst transfer failed" here a known 4.1.5  6.1.0 incompatibility, and if so, what is the recommended path out of it?

All logs are inline above — no attachment needed. I have a full NVM dump of the current 4.1.5 flash (741376-byte NVM_READ image) and can share it by whatever channel ADI prefers.