The question is not how they work in general, but how BR0 / OR0 are acting after a reset until they first get written to. [Which is problaby what your BDM4GDB init script does, which in turn is probably why you don't see the things you expect.]
You "misunderestimate" me. I've of course a minimal init script that does nothing but disable the watchdog reset. I've also already found out that the address put on the address bus (0xfff00100) is not influenced by the memory controller, that the flash is visible multiple times in the address space is only due to the fact that the most significant 8 bit of the address are not connected with the flash chips.
Whatever, with your rather cryptic hint you're probable referring to the MPC manual subsubsection "Boot Chip-Select Operation", which states that upon reset. "CS0 ist asserted for every address, unless an internal register is accessed." Single sentences are hard to find in 1.5K pages manuals, btw..
So this most probably means the memory controller doesn't care the least bit for the address mask in OR0 before OR0 is re-written, as CS0 is asserted anyway, no matter what OR0[AM] is.
It'd be a lie if I alleged I had been very happy with your hint, but with hindsight: Thanks again.
Best regards,
Peter Asemann