STM32L496 embedded bootloader CAN interface not working

[NFrit.2]

I'm using the STM32L496 and attempting to get the CAN communication working with the embedded bootloader. I can put the device into boot mode, but as soon as I send a CAN frame (0x79 Identifier, or any frame for that matter) the device seems to jump to or reset to the main application code. I would expect it to go into the bootloader where I can send the bootloader CAN commands. I have a 24MHz oscillator connected to the HSE pins.

[Tesla DeLorean]

Map the ROM into the zero-address space, or check the SCB->VTOR points at the ROM, not your app

[NFrit.2]

Update: It must be resetting when it receives the first CAN frame. When I let the boot0 pin go high and send the CAN frame, it goes to the main application. When I hold boot0 low and send the CAN frame, it stays in bootloader, but doesn't accept more CAN commands. Is there something causing it to reset when it receives a CAN frame?

[NFrit.2]

I can see the memory map and when it boots into the bootloader, and it is properly mapped to zero-address. When I then send a CAN frame, and re-read I can see the zero-address is now pointing to the application at 0x08000000.