Resolved! Flash page numbering in RM0444 and 0454 correct?
Rev. 5 of those RMs introduced dual-bank devices. According to "3.3.1 FLASH memory organization" the page numbers in bank 2 start at 256, which seems to be very odd as the PNB field in FLASH_CR has 10 bits, so one would expect 1024 instead.