Thank you for your response.
Looking at the ControllerSetBD_ADDR, it uses the function BOARD_GetMACAddr.
This function reads the RSIM->MAC_LSB and RSIM->MAC_MSB registers I have talked about in my post.
When executing ControllerSetBD_ADDR on a Freedom KW36 board, I see that the function also reads 0xFF from the RSIM registers.
The rest of the function then reads the MCU UID, uses the lower part of this ID, computes an SHA of the UID and uses that as MAC address.
/* Get MCUUID and create a SHA256 output */
BOARD_GetMCUUid(uid, &len);
SHA256_Hash(uid, len, sha256Output);
FLib_MemCpy(gHardwareParameters.bluetooth_address, sha256Output, mBD_ADDR_RandPartSize_c);
I do not understand why the MAC address registers are full or 0xFF. From my understanding, NXP garantees that a unique MAC address for all its KW series MCU are stored in these registers, as explaned in AN12272 :
NXP's Kinetis wireless microcontroller series (KW) include a unique 40-bit MAC address factory programmedwhich can be used to form a global unique address for BLE and IEEE 802.15.4 based wireless protocols. Itisincluded in KW40Z/30Z/20Z, KW41Z/31Z/21Z, KW35A/36A, KW35Z/36Z and K32W0x microcontrollers.