In S12XHY, if application would like to secure the BDM, SEC[1:0] in FSEC (0x7F_FF0F) could be set to 00/01/11, as manual says. If code downloaded through CyclonePro, all the function could be as manual described. But if used 3rd party tools to program the code into flash and read out flash data through bootloader, all the codes are same as design, but D-Flash operation was blocked when SEC[1:0] = 00/11.
There is a note for SEC[1:0] and 01 is the 'preferred SEC state to set MCU to secured state'.
Could you explain the difference for SEC[1:0] to be set as 00/11 and 01?