Update: After some debugging through the ROM code, it looks like the SDP read memory command doesn't perform a 32 bit access on the selected register. Instead it uses 8 and 16 bit access together with shift operations for getting a 32 bit value. These type of accesses are probably not supported by the EPIT.
ROM code:
1FFC|2E08 cmp r6,#0x8 // 8 bit?
1FFE|D01E beq 0x203E
2000|2E10 cmp r6,#0x10 // 16 bit?
2002|D055 beq 0x20B0
2004|2E20 cmp r6,#0x20 // 32 bit?
2006|D11C bne 0x2042 // else
2008|E08D b 0x2126 // goto 32 bit
...
// 32 bit
2126|2D00 cmp r5,#0x0 // count==0?
2128|D1C5 bne 0x20B6 // continue
...
20B6|2600 movs r6,#0x0 // i=0
20B8|2D40 cmp r5,#0x40 // (count>64)?
20BA|D311 bcc 0x20E0 // if (count < 64) goto 0x20E0
...
20E0|42AE cmp r6,r5 // (i < count)?
20E2|D3EC bcc 0x20BE // if (i < count) goto 0x20BE
...
// splitted access to 32 bit register!!!
20BE|7820 ldrb r0,[r4] // byte access!
20C0|55B8 strb r0,[r7,r6]
20C2|8820 ldrh r0,[r4]
20C4|1C76 adds r6,r6,#0x1 // i++
20C6|F3C02007 ubfx r0,r0,#0x8,#0x8
20CA|55B8 strb r0,[r7,r6]
20CC|6820 ldr r0,[r4]
20CE|1C76 adds r6,r6,#0x1 // i++
20D0|F3C04007 ubfx r0,r0,#0x10,#0x8
20D4|55B8 strb r0,[r7,r6]
20D6|CC01 ldm r4!,{r0}
20D8|1C76 adds r6,r6,#0x1 // i++
20DA|0E00 lsrs r0,r0,#0x18
20DC|55B8 strb r0,[r7,r6]
20DE|1C76 adds r6,r6,#0x1 // i++
20E0|42AE cmp r6,r5 // (i < count)?
20E2|D3EC bcc 0x20BE // next word
Result:
The SDP read command seems to ignore the provided access width. For some peripherals this may work, but for others not. For me this looks like an errata!