The camera has lots of safety features in place, like exception- and assertion handlers, which catch most of the Bad Things you can do to your camera. Writing to the 0xC0... area is generally safe.. in my experience. It appears to be some MMIO stuff and the camera occasionally kills itself when writing the wrong value to an address I'm not supposed to touch. I only recently bypassed the assertion handler (responsible for handling the majority of screwups) so the camera might just raise an assertion... Lots of tasks are probably constantly reading that area and take action depending on the values.
ASalina: the LED on the front (tally/timer LED on my S5IS) is PWM on my camera, I haven't been able to directly control it with 0x46. I had to use UniqueLedOn with the LED table or PostLEDMessage instead, supplying a PWM value which will then be fed into the LED. It's quite possible that the LED on the 40D behaves the same way so it might not be easily controllable. The same goes for the second LED (in theory) although it is unlikely. That LED probably indicates CF read/write activity, by the way. At least, that's what I deduce from your description, unless it also blinks on certain events that do not involve the CF card.
