I agree the KEYACC bit should have nothing to do with this issue but it does resolve the reads from RAM. I do have a service request on a related issue - when I attempt to erase a page of FLASH, the routine hangs waiting for confirmation the command has completed. If KEYACC is set early in the code, the routine completes BUT does not erase FLASH.
I am using the standard EraseFlash1, DoOnStack, and SpSub, BUSCLK at 2MHz, FCDIV at $09. I get no access errors or protection violation errors and the routine JSR to FlashErase1 returns fine but does not erase FLASH.
Is there anything that must be set or cleared before calling the EraseFlash1 routine?