"Apple's firmware appeared to assume that a pointer into one region could just be incremented into another."

I wonder if the presentation that the flash is 4 separate regions is false & actually the bug - or maybe it's a limitation because it's on 4 separate 512KB chips?

Don't know enough about EFI, just trying to attack the problem another way.