I kept thinking about this problem.
I based all my brcm,nvram development & testing on devices with serial flash used for bootloader & NVRAM. I never tried any device with NVRAM in NAND.
FWIW:
Serial flash is mapped at 0x1e000000
NAND flash is mapped at 0x1c000000
I think there may be some unexpected NAND controller behaviour caused by using NAND flash content mapping. My guess is that reading NAND content using mem IO somehow affects NAND controller state.
I'll try to contact Broadcom / NAND controller people see if they can help.