It appears I've found a silicon bug which is not yet in the errata:
If a cortex-m3 of the media controller subsystem attempts to access an invalid address on the external PPB, it apparently locks up the entire bus. The debugger can still access memory through the core's DAP, but any read from the PPB times out. Since the debug registers are located there, debugging the core is no longer possible. After resetting the core through PRCM it will run again until it tries to access any address on the PPB, which remains stuck. The problem even persists after a global warm reset. To get the subsystem working again, I have to apply a global cold reset.
The only plausible explanation is that the PPB is being locked up by the debug logic, even though it also happens if no debugger is attached and nTRST is pulled low. Is there any way to reset the media controller's debug logic from software, or perhaps trigger a local cold reset? (Shutting off the power domain would probably work, but the PRCM won't do that unless its standby request is acknowledged, for which both cores need to go into deep-sleep, which requires setting a bit in a register which is, of course, on the PPB.)