@User: That diagram is somewhat simplified, and I should have added another mux showing that the input to the user area from the pad is forced to zero when the "mgmt_ena" signal is on. This is mainly to protect the user area from whatever the management SoC might be doing on that pad. I hadn't really considered the usefulness of using that path as a test mechanism for the user I/O. I am probably not going to make a functional change like that at this late stage, but it's something I would definitely consider for the next shuttle run.