bootloader on 2560 starts at word address 0x1FE00. the compiler doesn't set EIND, so call to do_spm at atmega 2560, jumps to word address 0xFE01 where FFFF is in empty flash. FFFF is executed as skip one word if bit set. it is set, so it executes every other FFFF in the rest of the flash until bootloader where it hits the rjmp to do_sdm. it 'works' unless something is written in the flash above word address 0xFE01.
https://www.avrfreaks.net/forum/eicall-app-bootloader-atmega-2560-jumps-address-0x1fe01-without-eind-set
PS: I will not make a PR