If you look at table entitled "signal properties", you'll find that PM4-PM7 pull-ups are enabled out of reset, while PM3 pull-up is disabled out of reset. However PERM register rescription states all pull PORT M pullups should be off out of reset. Something's not right here. If "signal properties" is right, then PERM should read 0xF0 out of reset...