Lockup reset whenever writing on flash below 0x80000 on K64F

[Taiki]

For some reason trying to write to flash at adresses below 0x80000 on a K64F card makes the board reset with the LOCKUP flag set on SRS1. This happens reliably with the minimal code that follows and only when uVisor is activated.
This code works fine when uVisor is disabled and the supporting code (FEATURE_UVISOR) is removed. Writes to adresses higher or equal to 0x80000 (the second flash bank) work flawlessly. All flash security features appear to be disabled.

#include "mbed.h"
#include "FreescaleIAP.h"

const char __attribute__((section(".text.update.memory"), aligned(SECTOR_SIZE))) buffer[SECTOR_SIZE] = {'t', 'e', 's', 't'};

#ifdef FEATURE_UVISOR
	#warning "uVisor is enabled"
	#include "uvisor-lib/uvisor-lib.h"

	static const UvisorBoxAclItem g_main_box_acls[] =
	{
		{SIM, sizeof(*SIM), UVISOR_TACLDEF_PERIPH},		//System Integration Module
	 	{PIT,   sizeof(*PIT),   UVISOR_TACLDEF_PERIPH},	//Timer
		{OSC,   sizeof(*OSC),   UVISOR_TACLDEF_PERIPH},	//Oscillator System Control
		{MCG,   sizeof(*MCG),   UVISOR_TACLDEF_PERIPH},	//Multipurpose Clock Generator
		//Flash Access
		{FTFE,  			sizeof(*FTFE),	UVISOR_TACLDEF_PERIPH},
		{UART0,  			sizeof(*UART0),	UVISOR_TACLDEF_PERIPH},
	};

	//Enable uVisor, using the ACLs we just created.
	UVISOR_SET_MODE_ACL(UVISOR_ENABLED, g_main_box_acls);
#else
	#warning "uVisor is disabled"
#endif

int main()
{
	char message[] = "This is a random sample message";

	//We know that buffer is sector aligned
	erase_sector((int) buffer);
	program_flash((int) buffer, message, sizeof(message));

	printf("Test -> %32s\n", buffer);
	while(1);
}

Because the code work fine without uVisor, I assumes the issues is mostly unrelated to this topic https://os.mbed.com/questions/61668/Cant-flash-below-address-0x80000-in-K64F/

This issue appears unrelated to ACLs missing as no bus fault is thrown and instead of locking up, the CPU merely reboot. This happens at the erase_sector call unless a debugger is used to step instruction per instruction.
uVisor debug log loop on the following:

uVisor mode: 2
uvisor_ram : @0x1FFF0400 (7168 bytes) [config]
             @0x1FFF0400 (7168 bytes) [linker]
bss_boxes  : @0x1FFF2000 (128 bytes) [config]
Box 0 ACLs:
  - Peripheral: 0x40047000 - 0x40048064 (permissions: 0x0AB6)
  - Peripheral: 0x40065000 - 0x40065001 (permissions: 0x0AB6)
  - Peripheral: 0x40064000 - 0x4006400E (permissions: 0x0AB6)
  - Peripheral: 0x40020000 - 0x40020018 (permissions: 0x0AB6)
  - Peripheral: 0x4006A000 - 0x4006A020 (permissions: 0x0AB6)
vmpu_enumerate_boxes [DONE]
page heap: [0x20000000, 0x20000000] 0kB -> 0 16kB pages
uvisor initialized

The FreescaleIAP (mbed add http://os.mbed.com/users/Sissors/code/FreescaleIAP/) disables IRQs before performing write operations but removing those barriers doesn't solve the issue.
According to ARM's Cortex M4 documentation, lockup events are caused when a fault is thrown in the HardFault/NMI handler but implementing them didn't result in either being called (or at least no breakpoint in them being triggered).

After exhausting the various avenues of debugging I could think of and getting down to this minimal code, I am not sure which options are available to get more information on what happens to trigger those lockups.

[ARM mbed CI]

ARM Internal Ref: IOTSEC-577