The region appears to cover both sections of the firmware and the non-volatile storage, so it's entirely possible that the reason for the segmented regions is that they do represent different functional domains (either separate chips, or separate regions of a single lump of flash). Given that it works fine when it's collapsed into a single region there's no real reason it couldn't have been presented that way - or, alternatively, the firmware could just not make the assumption that they're going to be contiguous in virtual space. I'm pretty sold on this being a real firmware bug, just one that it's easy for us to work around.