How does the STM32 knows where should the .BSS section be addressed,and what's the range,when the chip startup initially? We know that firmware downloaded into the flash contains section information like .text ,.data ect,while .bss section should be ...

The STM32 Selection Guide 2021 Shows that STM32F407VET6 contains 512K flash, but actually the flash could be wroten from address 0x0800 0000 to the 0x080F FFFF, So what's the problem?!