So there's this one chip I'm working with - it has all the "life support" peripherals (reset controller, watchdog) run with a "slow clock" than is by default generated by an internal RC oscillator, but it can also be supplied externally (either as a clock signal or with a crystal).

Switching the slow clock from internal RC to external can be done by writing to a single 32 bit register with an 8-bit key and a single bit. The only way to switch back to internal is to cycle power.

Switching to external with no external clock source present will essentially turn off anything that runs off that clock.

Is it just me or does this arrangement have a design flaw? One write can essentially turn off the watchdog and the reset controller, and the only way to get out of this state is to cycle the power (no, a reset alone won't do it, and the chip can't be reset without the slow clock being present since the reset controller needs that clock; and the watchdog will no longer fire since it's based on a counter that's running off the aforementioned slow clock).