Sorry, this is a ‘false alarm’.
We had used the schematic of the reference design, which uses a parameter with value of ‘no stuff’, but our system used other parameter (DNP), and I missed R248, which was assembled, and divided the ‘CARRIER_PWR_ON’ signal from the SOM.
So during the first debug stage, as the system didn’t powered up, we’ve placed several bypasses, but actually didn’t use the ‘CARRIER_PWR_ON’.
Once we’ve removed R248 and restored the bypasses, the system power-off correctly.