I started exploring how the extra space might be used. Here's a quick concept drawing, with the added parts highlighted.
View attachment 17964
Switching to the larger 12mm chip (necessary for escaping more signals with an affordable PCB) and adding a USB host stuff (highlighted yellow) and SD socket similar to Teensy 3.6 uses up nearly all the space. I guess that's not too surprising, since Teensy 3.6 has a 13mm chip and not much room left over.
At first it seemed impossible to fit an ethernet PHY and a connector. The 4mm LAN8720 chip I've used before just can't fit, unless the connector is extremely small (and fragile). Then I discovered Texas Instruments has a
relatively new PHY chip that squeezes the PHY into only 3mm, using a rather strange QFN package. That allows a 2mm pitch through-hole header for the ethernet signals.
One downside to the ethernet PHY chips is about 1 to 2 mA current in their lowest possible power down modes. Of course we'll still support the power on/off feature which will also shut off all power to the PHY.
Which signals to assign to pins 34-41 is still a wide open decision. AD_B1_04, AD_B1_05, AD_B1_12, AD_B1_13 seem like reasonable candidates. That would give 16 bits of a port (though how useful that really is with the GPIO supporting only 32 bit access is questionable) and would also give 16 signals for FlexIO3 (perhaps much more useful). But those 4 pins are sort of lackluster in peripheral features, which is the reason they weren't included in the Teensy 4.0 pinout.
Signals B1_12 & B1_13 would give us access to the last serial port (UART5). Or EMC_23 & EMC_24 could as well, if those signals are used for a place to add a memory chip (which would be on the bottom side - pads similar to the bottom side of the audio shield, but FlexSPI so the memory chip gets mapped into the ARM address space).
This is all very tentative. Now is the time for feedback!