The check bits of R2 response should be 2'b111111 and the CRC7 should not protect these bits.
The following code should be inserted between lines 657 and 658 of the "sdModel.v"
if (response_S == 136)
crcEn<=(cmdWrite >= 6);
and line 466 of "sd_cmd_serial_host" shoud be updated as
CRC_Enable=(Response_Size <= 40 || Cmd_Cnt > 7);
to fix this problem.
if (response_S == 136) crcEn<=(cmdWrite >= 6);
I didn't notice that the errata would be truncated because of the HTML-syntax. It should be
if (response_S == 136)
crcEn\<=(cmdWrite \>= 6);
CRC_Enable=(Response_Size \<= 40 || Cmd_Cnt\ > 7);
I can't submit the errata. FYI. http://r80166.blogspot.tw/2013/01/sdmmc-device-controller.html