Hello Kang Kang,
Thanks for the hint - yes, BAT_DET is set. Our current observation show that this bug seems to be closely related to this bug: http://e2e.ti.com/support/power_management/battery_management/f/180/t/269283.aspx
We had to decrease I2C speed in order to fix both issues: I'm still very curious to know, why only register 0x41 was affected by I2C speed (and all other registers were read correctly). It is also strange that any delays introduced -between- I2C reads did not fix the problem, but delays between each I2C bit fixed them. Looks like this is some kind of very deep BQ feature, which is causing specific register read failures and subsequent SOC/RM resets.