Uploaded the srecord and it looks a bit different from what went in. The first 16 lines are FF, the next line is unknown data, the next 4 are as per what was programmed in. Is some of it written to unimplemented addresses?
Original and retrieved srecord below. Can't seem to get the formatting right, sorry! "source code" button doesn't do anything useful on my browser...
Original
S1120000A696C7303EA680C73038A600C7303951
S113C0006E00006E00016E0003A600C730B8A600E3
S113C010C730B0A600C730B9A600C730B1A600C764
S113C02030BAA600C730B2A600C730BBA600C730DE
S113C030B3A600C730BCA600C730B49B989C5F4F22
S113C0401003453039AFFF65000026F91103453070
S10EC05039AFFF65000026F9CCC045A5
S105FFFEC0003D
S9030000FC
Retrieved
S1133100FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFCB
S1133110FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBB
S1133120FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFAB
S1133130FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF9B
S1133140FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8B
S1133150FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7B
etc etc etc
S113FFE0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1D
S113FFF0FFFFFFFFFFFFFFFFFFFFFFFFFFFFC0004B
-----------------------------
EDIT -> I had some of the config registers listed above ORG $C000 so the srecord was being partially written to the non-flash area.
:facepalm: ....