I'm trying to understand the Teensy 3.6 at the register level. One thing that puzzles me is that the address for FTM2_MOD is defined in kinetis.h as 0x400B8008, but in the manual the address is 4003_A008 (page 1141). My question is why aren't these addresses the same?

The manual explains (page 106) that the peripheral bridge is set up with AIPS-Lite0 at 0x4000_00000x4007_FFFF and AIPS-Lite1 at 0x4008_00000x400F_EFFF.
Based on this, I hypothesized that the two addresses are equivalent, going through different peripheral bridges. But two things confuse me. First, accessing the address in the manual crashes the Teensy. Second, the FTM2_MOD address from the manual ends in A008, while the code's address ends in 8008 so it's not a straightforward mapping from AIPS-Lite0 to Lite1.

void setup() {
    Serial.println(*(uint32_t *)0x400b8008, DEC);
    Serial.println("Printed FTM2_MOD");
    Serial.println(*(uint32_t *)0x40038008, DEC); // works
    Serial.println("Printed FTM0_MOD");
    Serial.println(*(uint32_t *)0x4003A008, DEC); // crashes?
    Serial.println("Printed alternate FTM2_MOD"); // not printed
So why does the Teensy code use a different FTM2_MOD address from the one in the manual, which apparently doesn't work?