The Reference Manual (IMX35RM, Rev. 2, 3 2009) claims an offset of 0x200 for HS. When host support was implemented only a preliminary document was available, which told 0x400. This works fine.