While I am not a lawyer, I have dealt a lot with different software licenses (both as a client and as a vendor), and although hardware licensing is somewhat different, I do claim I recognize certain things in the language used here.
If I were you, I'd happily use SDIO to access an internal microSD card, and not bother getting a commercial host license. I would simply be diligent in that nothing in the product or its documentation referred to "SD card" or the SD pictogram (except for on the physical SD card), and consistently used e.g. "memory card with a FAT-compatible filesystem on it". At the point when the product sales exceed 1000 units in a single year, I'd reconsider the situation (but most likely continue with the same strategy).
Note that I am somebody who is extremely diligent with respect to copyright and licensing; only somewhat immune to copyright and license
marketing and hoodwinkery, which I absolutely detest. I respect the idea and the execution, and lawful contracts, but I am not going to pay for salespeoples wet dreams.
The reason why I'd not worry about a license at small volumes of sales for internal use, is the exact wording on the sdio.org website about who requires what kind of a license,
and what that license provides; and the
relationship between MMCplus and SDIO, especially wrt. the 4-bit data bus, and what that means with respect to patent coverage, considering MMCplus has no host license requirements. The fact that that list of patents is kept extremely carefully under wraps tells me a lot.
The way I see it, the license covers the registered trademarks and pictograms, and defuses an implied threat of litigation wrt. undisclosed patents. OneLaptopPerChild community news on
2006-09-16 mentions they do not believe their implementation requires a commercial license, for example.
When you make a decision yourself, do not rely on my opinion here, obviously. But do consider pointing out these things to the lawyer you consult with, to make sure they grasp the whole picture. Then again, consulting a lawyer is likely going to cost at least the same as a host license for a year, so...
That PDF I could not find is all over Chinese sites but none of them actually deliver it, which suggests that this was the full spec including the "confidential" parts referred to at the SDCARD website.
Are you referring to the
Physical Layer Simplified Specification v6.0, as linked from the Wikipedia
Secure Digital page? See the
Openness of specification chapter. In chapter 4.5, it mentions that the CRC7 is 7-bit, and uses generator polynomial G(x)=x
7+x
3+1; and CRC16 is 16-bit with generator polynomial G(x)=x
16+x
12+x
5+1.