Immutable bootloader + MCUBoot. External Flash. Update fails into bootloop.

[optical]

I have application with functional configuration MCUBoot + (Spm + application). Now i'm trying to add immutable bootloader which works.
However when i attempt to update te immutable bootlaoder using dfu_target_mcuboot. The update fails. Resulting into bootloop.

The immage is uploaded successfuly, however the swapping done by the mcuboot must be somehow corrupted, because the image is functional in slot S1.
I have validated its functionality by uploading the s1 image using nrfjprog with sector erase and the MCUBoot s1 image booted without the BUS FAULT.

Configuration:
Immutable,
S0 - Mcuboot(FW_INFO=1)
{
    S1 - Mcuboot(FW_INFO=2) - Working when uploaded with programmer, with sector erase.
    S1 - Mcuboot(FW_INFO=2) - Not working when uploaded with dfu target.
}

I'm attaching RTT output from the mcuboot which shows the update process.
1 - Application performing update using dfu_target_mcuboot
2 - Mcuboot swaping the s1 image into PM_S1. 
The mcuboot is jumping according to pm_partions.yml into mcuboot_pad from some reason instead of the application. Which i dont know is correct or not. During normal boot the RTT always cuts of to verify the address from wokring mcuboot.
3 - Mcuboot trying to revert the S1 image. Fails.
4 - Mcuboot is stuck inside bootloop.

Could somebody provide me with some hints why would the mcuboot image inside the S1 partition fails when update though dfu_target_mcuboot ? 

NCS Version 1.5.0

mcuboot_pad:
address: 0x58000
end_address: 0x58200
placement:
before:
- mcuboot_primary_app
region: flash_primary
sharers: 0x2
size: 0x200
mcuboot_primary:
address: 0x58000
end_address: 0xfa000
orig_span: &id002
- mcuboot_pad
- app
- spm
region: flash_primary
size: 0xa2000
span: *id002
mcuboot_primary_app:
address: 0x58200
end_address: 0xfa000
orig_span: &id003
- app
- spm
region: flash_primary
size: 0xa1e00
span: *id003

Standard boot. Used DFU target to upload new version of MCUBoot S1 image.
00> *** Booting Zephyr OS build v2.4.99-ncs1-16-g1f4e57428539  ***
00> 
00> [00:00:00.014,495] <inf> mcuboot: Starting bootloader
00> [00:00:00.015,289] <inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:00.015,777] <inf> mcuboot: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:00.015,777] <inf> mcuboot: Boot source: none
00> [00:00:00.016,448] <inf> mcuboot: Swap type: none
00> [00:00:00.016,937] <inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:00.017,395] <inf> mcuboot: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:00.017,395] <inf> mcuboot: Boot source: none
00> [00:00:00.018,066] <inf> mcuboot: Swap type: none

Boot swaping the S1 image from the MCUBOOT_SECONDARY to the PM_S1
00> *** Booting Zephyr OS build v2.4.99-ncs1-16-g1f4e57428539  ***
00> 
00> [00:00:00.014,495] <inf> mcuboot: Starting bootloader
00> [00:00:00.015,289] <inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:00.015,777] <inf> mcuboot: Secondary image: magic=good, swap_type=0x2, copy_done=0x3, image_ok=0x3
00> [00:00:00.015,777] <inf> mcuboot: Boot source: none
00> [00:00:00.016,448] <inf> mcuboot: Swap type: test
00> [00:00:00.274,688] <inf> mcuboot: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:00.275,146] <inf> mcuboot: Secondary image: magic=good, swap_type=0x2, copy_done=0x3, image_ok=0x3
00> [00:00:00.275,177] <inf> mcuboot: Boot source: none
00> [00:00:00.275,848] <inf> mcuboot: Swap type: test
00> [00:00:46.803,802] <inf> mcuboot: Bootloader chainload address offset: 0x58000
00> [00:00:46.803,833] <inf> mcuboot: Jumping to the first image slot
00> [00:00:46.803,833] <err> os: ***** BUS FAULT *****
00> [00:00:46.803,863] <err> os:   Precise data bus error
00> [00:00:46.803,863] <err> os:   BFAR Address: 0x5
00> [00:00:46.803,863] <err> os: r0/a1:  0x00000381  r1/a2:  0x00014d6b  r2/a3:  0x20024f88
00> [00:00:46.803,863] <err> os: r3/a4:  0x00000381 r12/ip:  0x00000380 r14/lr:  0xe000ed00
00> [00:00:46.803,863] <err> os:  xpsr:  0x0000ce00
00> [00:00:46.803,863] <err> os: Faulting instruction address (r15/pc): 0x200232c7
00> [00:00:46.803,863] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
00> [00:00:46.803,863] <err> os: Current thread: 0x20018c08 (unknown)
00> [00:00:46.803,863] <err> fatal_error: Resetting system


Trying to revert the crashed mcuboot image:
00> *** Booting Zephyr OS build v2.4.99-ncs1-16-g1f4e57428539  ***
00> 
00> [00:00:00.014,465] <inf> mcuboot: Starting bootloader
00> [00:00:00.015,258] <inf> mcuboot: Primary image: magic=good, swap_type=0x2, copy_done=0x1, image_ok=0x3
00> [00:00:00.015,747] <inf> mcuboot: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:00.015,747] <inf> mcuboot: Boot source: none
00> [00:00:00.016,418] <inf> mcuboot: Swap type: revert
00> [00:00:00.274,475] <inf> mcuboot: Primary image: magic=good, swap_type=0x2, copy_done=0x1, image_ok=0x3
00> [00:00:00.274,932] <inf> mcuboot: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:00.274,963] <inf> mcuboot: Boot source: none
00> [00:00:00.275,634] <inf> mcuboot: Swap type: revert
00> [00:00:00.533,813] <inf> mcuboot: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:09.288,757] <inf> mcuboot: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:10.245,056] <inf> mcuboot: Bootloader chainload address offset: 0x58000
00> [00:00:10.245,086] <inf> mcuboot: Jumping to the first image slot
00> [00:00:10.245,086] <err> os: ***** BUS FAULT *****
00> [00:00:10.245,117] <err> os:   Precise data bus error
00> [00:00:10.245,117] <err> os:   BFAR Address: 0x5
00> [00:00:10.245,117] <err> os: r0/a1:  0x00000381  r1/a2:  0x00014d6b  r2/a3:  0x20024f88
00> [00:00:10.245,117] <err> os: r3/a4:  0x00000381 r12/ip:  0x00000380 r14/lr:  0xe000ed00
00> [00:00:10.245,117] <err> os:  xpsr:  0x0000ce00
00> [00:00:10.245,117] <err> os: Faulting instruction address (r15/pc): 0x200232c7
00> [00:00:10.245,117] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
00> [00:00:10.245,117] <err> os: Current thread: 0x20018c08 (unknown)
00> [00:00:10.245,117] <err> fatal_error: Resetting system

Stuck in boot loop.
00> *** Booting Zephyr OS build v2.4.99-ncs1-16-g1f4e57428539  ***
00> 
00> [00:00:00.014,495] <inf> mcuboot: Starting bootloader
00> [00:00:00.015,289] <inf> mcuboot: Primary image: magic=good, swap_type=0x4, copy_done=0x1, image_ok=0x1
00> [00:00:00.015,777] <inf> mcuboot: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:00.015,777] <inf> mcuboot: Boot source: none
00> [00:00:00.016,448] <inf> mcuboot: Swap type: none
00> [00:00:00.016,937] <inf> mcuboot: Primary image: magic=good, swap_type=0x0, copy_done=0x1, image_ok=0x1
00> [00:00:00.017,395] <inf> mcuboot: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
00> [00:00:00.017,395] <inf> mcuboot: Boot source: none
00> [00:00:00.018,066] <inf> mcuboot: Swap type: none
00> [00:00:00.172,241] <inf> mcuboot: Bootloader chainload address offset: 0x58000
00> [00:00:00.172,241] <inf> mcuboot: Jumping to the first image slot
00> [00:00:00.172,271] <err> os: ***** BUS FAULT *****
00> [00:00:00.172,271] <err> os:   Precise data bus error
00> [00:00:00.172,271] <err> os:   BFAR Address: 0x5
00> [00:00:00.172,271] <err> os: r0/a1:  0x00000381  r1/a2:  0x00014d6b  r2/a3:  0x20024f68[0m
00> [00:00:00.172,271] <err> os: r3/a4:  0x00000381 r12/ip:  0x00000380 r14/lr:  0xe000ed00
00> [00:00:00.172,271] <err> os:  xpsr:  0x0000ce00
00> [00:00:00.172,271] <err> os: Faulting instruction address (r15/pc): 0x200232c7
00> [00:00:00.172,271] <err> os: >>> ZEPHYR FATAL ERROR 0: CPU exception on CPU 0
00> [00:00:00.172,271] <err> os: Current thread: 0x20018c08 (unknown)
00> [00:00:00.172,271] <err> fatal_error: Resetting system

[optical]

Note that the same behavior is present when the signed_by_mcuboot_and_b0_s1_image_update.bin image is uploaded directly using mcumgr img subsystem.
Which points to issue inside the MCUBoot swaping functionality it self not the dfu_target.

[optical]

I have added logging inside the mcuboot to show me where the application is beeing swapped. The s1 image is beeing swapped to the mcuboot_primary partition which corrupts the mcuboot_pad. Which then leads to mcuboot crasing with BUS FAULT. 
Am i missing some KConfig option so the MCUBoot detects correctly the place where the S1 image should be swapped ? 

[optical]

My most worrying concern is that how is it possible to upload image inside the secondary partition which then corrupts the primary even when mcuboot does the revert operation making the device essentially bricked.

[optical]

Is it possible that mcuboot nrf-noup commit does not take into account mcuboot_secondary inside external flash. I believe that the issue is in these lines inside mcuboot:

    const struct flash_area *secondary_fa =
        BOOT_IMG_AREA(state, BOOT_SECONDARY_SLOT);
    struct image_header *hdr = (struct image_header *)secondary_fa->fa_off;

These lines are using the fa_off set directly as pointer to image_header which is of course not there of the secondary_fa is located in external memory.

[optical]

I can confirm that the image indeed started to be swapped to correct location after i changed the direct memory access to flash_area_read.