In the end of June, I found out how to fix that pesky r2/r13 register problem.
I had to mark r2 and r13 as "unaffected" in a few "ppc_64*.cspec" files in the #Ghidra Processors/PowerPC/data/languages folder.

Then, most memory accesses got resolved correctly.
Probably not the best solution, but it worked.

And I could finally dive head first into the actual reverse engineering.

I spent many dozens of hours losing track of time in #Ghidra (I swear, it's worse than #Factorio)

Until I had figured out the #CAN message handling, signal parsing and where and when which #DTC codes get set.
With that knowledge I could figure out, slowly but surely, what the #startergenerator needs to run.
Even #FBS4 was pretty trivial to circumvent (a single 1 written to the right memory location via #XCP)

And after implementing the ~25 CAN messages in my STM32 code I finally got this today:

But it looks like some kind of structured data (see attached image, a normal firmware doesn't look like this, ime). Almost looks like many structs after each other, but idk. Maybe some weird #AUTOSAR thingy?
I also threw #Ghidra against the dump with some of the suspected architectures ( #MCP5xxx, #PowerPC, #Tricore), but none returned any plausible looking instructions.

If anyone has an idea how the firmware of a Mercedes / Bosch ECU from ~2016 could be structured, hmu.