Zephyr, defeating C_NULL_POINTER_EXCEPTION protection

I'm working on a project that uses Zephyr on a Nordic nRF52840 ARM CortexM. In the build they have the C NULL pointer exception protection enabled with:

CONFIG_NULL_POINTER_EXCEPTION_DETECTION_MPU=y
CONFIG_CORTEX_M_NULL_POINTER_EXCEPTION=y
CONFIG_CORTEX_M_NULL_POINTER_EXCEPTION_PAGE_SIZE=0x400

They do not have CONFIG_USERSPACE set.

I would like to do a CRC32 on the bootloader that's flashed from 0-0xC000, however trying to read any addresss from 0-0x3FF generates an MPU fault, because of the null pointer exception protection above which MPU protects that 0-0x3FF region against reads and writes. I thought I might be able to work around this protection by writing a __syscall function to call the crc32 function (which reads the protected area); however, the code the build generated (below) only elevate privileges if CONFIG_USERSPACE is enabled (which it isn't) so in this case it's just calling the function directly.

I've added
CONFIG_APPLICATION_DEFINED_SYSCALL=y

In ./build/zephyr/include/generated/syscalls/crc32_ieee_syscall.h:

extern void z_impl_crc32_ieee_syscall(void* pData);

__pinned_func
static inline void crc32_ieee_syscall(void* pData)
{
#ifdef CONFIG_USERSPACE
    if (z_syscall_trap()) {
        /* coverity[OVERRUN] */
        arch_syscall_invoke1(*(uintptr_t *)&pData, K_SYSCALL_CRC32_IEEE_SYSCALL);
        return;
    }
#endif
    compiler_barrier();
    z_impl_crc32_ieee_syscall(pData);
}

In my application code:

int configuration::get_bootloader_data(BootloaderData* pData)
{
   ...
   crc32_ieee_syscall(pData);
   return 0;
}

...

void z_impl_crc32_ieee_syscall(void* pData)
{
   pData->dwCRC = crc32_ieee((const uint8_t*)pData->dwStartAddr,
                              pData->dwEndAddr - pData->dwStartAddr + 1);
}

In application code header:

#pragma once

__syscall void crc32_ieee_syscall(void* pData);

#include <syscalls/crc32_ieee_syscall.h>

I also tried setting -D__ZEPHYR_USER__ for the module that uses the header file (above) but that didn't seem to help either.

Is there an easy way... or some other method... to work around this problem?

Thanks!