The bootloader programs only unlocked PMA entries (no PMP), so the layout is not a bootloader<->application ABI; the application resets all entries, programs them in ascending order from IRAM, and locks everything. Verified on ESP32-H4 v0.1.