I am not able to access the session registers over I2C at address 0xFE. I see the session registers from the NFC side with no problem at 0xEC/0xED. I have also no problem reading and writing the configuration registers at 0x3A from the I2C side, but it takes effect only after power on reset, as expected.
If I read 0xFE from the I2C side, I receive only 0xff, I am not sure if these are real values or a "invalid access" result.
I have also no problem reading the last SRAM block at 0xA9 using I2C, but from 0xFB until 0xFF I see only 0xFF's.