I'm debugging some corner-cases with my own DFU process and Bootloader. I believe I hit a race condition in which sd_mbr_command() was called before the source of the new Bootloader was written. Thus, the MBR copied clear flash to the Bootloader location.
However, the device restarted and ran as usual, without a Bootloader. I ran an short experiment where I added a line to erase the Bootloader when the Application starts up, and indeed, it can still reset normally.
Is it expected behavior that the MBR is "smart enough" to run the Application when UICR is programmed with a Bootloader location containing blank flash?