Resolved! What causes HAL_FLASH_OB_Unlock() to call HardFaultHandler()? It calls WRITE_REG(FLASH->OPTKEYR, FLASH_OPTKEY1); and jumps directly to HardFaultHandler().
The HAL_FLASH documentation is especially poor. There in no overview of what you have to do. You would think (because of lack of anything saying different) you have to HAL_FLASH_OB_Unlock()HAL_FLASH_Program(...)HAL_FLASH_OB_Lock()The first command H...