The hidden JTAG in a Qualcomm/Snapdragon device’s USB port

So just to get this straight, Qualcomm has a piece of custom silicon, as a peripheral controlled by registers, that when enabled reroutes the ARMs USB pins through it (adding a USB hub in the middle), and on that hub it adds a SWD programmer and a serial port that connect back to the ARM core's IOs? Amazing!

Just wait until you find out about Apple's magical USB shenanigans like the Chimp Cable https://www.theiphonewiki.com/wiki/Chimp_Cable

This USB-based debug approach is becoming standard practice across SoC vendors (MediaTek's preloader, Apple's special cables) as it eliminates dedicated debug headers while maintaining controlled access through eFuse-gated authentication.