I found a bug in HAL_RCC_OscConfig for stm32f2xx (file stm32f2xx_hal_rcc.c).
When this function is called with the OSC configured, e.g. from bootloader, it checks if the PLLM/N/P/Q in RCC PLLCFGR reg are the same as requested. That check fails, even if the parameters in the second config request are the same.Problem is locate...