Thanks, @diego_charles. To my knowledge, I need help calculating the CRC value that needs to be populated at offset 0x28, as well as ensuring that CRC validation is actually happening. The image length is populated at offset 0x20, and the value 0x2 (plain image with CRC - load to RAM) is populated at offset 0x24.
I've been working from the assumption that the internally calculated CRC at bootup uses the built-in CRC Engine module. From that, I've developed an algorithm to calculate the CRC based on the flowchart in the attached PDF.
Unfortunately, it does not appear that CRC validation is being performed at bootup. That is, even if I deliberately invalidate the CRC, the firmware application still runs. My expectation was that the device would get stuck in the bootloader.