All FR5xx devices specify that the interrupt vector starts at 0xFF80, causing the toolchain to fill unused entries with a pointer to the default interrupt handler. This is consistent with the data sheets, but in fact the FR5xx user's guide tells us that there are BSL and JTAG passwords stored in the 0xFF8x area. It seems likely that storing the default interrupt handler address in this area is the cause of the FRAM "fuse blown" issue with mspdebug. There is also some evidence that suggests that if the default interrupt handler has an address where the low byte matches the BSL configuration TLV tag, BSL can be locked out.
Need to figure out a way to prevent the values in the lower part of the interrupt vector table from being overwritten.