OK, there's no problem with MMU, all TLB entries are "user access allowed".
After deeper investigation, I found that it's caused by default configuration of Peripheral Bridge.
It's necessary to configure AIPS_1_OPACRA to 0x44440444 (default value is 0x44444444):



After this configuration, it works as expected.
Regards,
Lukas