I'll have to see if we can get the shield off to get to the SPI bus. This is the ESP32-WROOM-32UE variant with onboard external flash and the SPI bus is not connected to the package's pins. Sorry, I should have picked up on this earlier.

Good catch, yes decremented by 1. Does anyone know if the source for the first stage bootloader is available?

Thanks WiFive, good suggestion. Yes, I've dumped the second stage header from flash and it looks fine to me. 00001000: e904 024f a806 0840 ee00 0000 0000 0000 ...O...@........ 00001010: 0000 0000 0000 0001 1800 ff3f 0400 0000 ...........?.... 00001020: ffff ffff 1c00 ff3f 1404 0000 0000 0000 ..........

One of our development boards that gets a fair amount of abuse has recently developed a boot failure: ets Jul 29 2019 12:21:46 rst:0x1 (POWERON_RESET),boot:0x13 (SPI_FAST_FLASH_BOOT) configsip: 0, SPIWP:0xee clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00 mode:DIO, clock div:...