Do you know how the SDK functions in ROM got hooked up or activated when there's user code calling them.
How are those functions got retrieved and referenced?
Secondly, 0x4000000 is 128MB physical address. ESP doesn't have that much physical memory! -