nRF9161DK SPI p_reg->PSEL assignment caused Bus Fault

The code base is the non_blocking SPI sample code configured for nRF9161DK.

in prj.conf

CONFIG_NRFX_SPIM1=y
At initialization inside 
nrfx_spim_init() this happened:
[00:00:00.308,288] <err> os: ***** BUS FAULT *****
[00:00:00.308,319] <err> os: Precise data bus error
[00:00:00.308,319] <err> os: BFAR Address: 0x0
[00:00:00.308,349] <err> os: r0/a1: 0x40009000 r1/a2: 0x2000e050 r2/a3: 0x00000000
[00:00:00.308,349] <err> os: r3/a4: 0x00000017 r12/ip: 0x2000c7a0 r14/lr: 0x000170e5
[00:00:00.308,380] <err> os: xpsr: 0x01000000
[00:00:00.308,380] <err> os: Faulting instruction address (r15/pc): 0x0001d8a6
[00:00:00.308,441] <err> os: >>> ZEPHYR FATAL ERROR 25: Unknown error on CPU 0
[00:00:00.308,471] <err> os: Current thread: 0x2000cc38 (unknown)
[00:00:00.383,026] <err> os: Halting system
 
Running in debug showed the fault occurred in the SDK v2.6.0, inside the function nrfy_spim_periph_configure() and an inline function 
nrf_spim_pins_set():
        p_reg->PSEL.SCK  = p_config->pins.sck_pin;
        p_reg->PSEL.MOSI = p_config->pins.mosi_pin;
        p_reg->PSEL.MISO = p_config->pins.miso_pin;
Have checked these port assignment didn't have conflict with anything else on the 9161DK. The order of the three lines didn't matter. Hitting any of the PSEL register will cause a "bus fault". This happened regardless of the SPI slave being connected or disconnected.
For bus errors, one would expect some bad pointer would cause it. But p_reg is looking legit pointing to 0x40009000 (or is it bad?), and p_config is pointing to good values. 
Any information what this might be caused by? 

Related