Banks swapped despite (0 == READ_BIT(FLASH-OPTR, FLASH_OPTR_SWAP_BANK))

[_andreas]

I've come across an MCU with UID {0x210044, 0x474b500e, 0x20383736} where banks are swapped despite the fact that this is not configured in the option bytes.

#include <stm32u5xx.h>
#include <stm32u585xx.h>

#define FLASH_KEY1                0x45670123U /*!< Flash key1 */
#define FLASH_KEY2                0xCDEF89ABU /*!< Flash key2: used with FLASH_KEY1 to unlock the FLASH registers access */

void main(void) {
    unsigned bank = 1;
    
    WRITE_REG(FLASH->NSKEYR, FLASH_KEY1);
    WRITE_REG(FLASH->NSKEYR, FLASH_KEY2);
    
    FLASH->NSCR = FLASH_NSCR_PER | (bank << FLASH_NSCR_BKER_Pos) | (0 << FLASH_NSCR_PNB_Pos);
    __DMB();
    SET_BIT(FLASH->NSCR, FLASH_NSCR_STRT);
    __DMB();
    while(READ_BIT(FLASH->NSSR, FLASH_NSSR_BSY)) ;
    
    SET_BIT(FLASH->NSCR, FLASH_NSCR_LOCK);
}

When bank = 1 (as in the code shown) on this MCU it will erase the flash page starting at address 0x08000000, instead of the expected flash page starting at 0x08100000. Since the MCU runs the code from flash, this results in a catastrophe.

Should I program a test for this issue during production?

If this issue is present, can I rely on it to be stable?