Problems with erasing and programming PFlash on AURIX TriCore (tc0), TC277-DC

I've whittled the code down from Infineon to just this little bit:

static void FlashDemo(void)
{
uint16 endinitSfty_pw;
uint32 sector_addr = 0xaf008000;

endinitSfty_pw = IfxScuWdt_getSafetyWatchdogPassword();

/* erase program flash */
IfxScuWdt_clearSafetyEndinit(endinitSfty_pw);
IfxFlash_eraseSector(sector_addr);
IfxScuWdt_setSafetyEndinit(endinitSfty_pw);
}

If you change the sector address from a Data Flash sector (somewhere in the 0xaf00xxxx range) to a Program Flash sector (somewhere in the 0xa0000xxxx range) then the code executes until the call to IfxFlash_eraseSector() and then resets the core (or jumps to the reset vector), executes the user code again and on the second invocation of IfxFlash_eraseSector(), the cores halt and the "RESET LED" (D604) lights red.

If the Flash address is within the Data Flash range, the code works fine.

If I copy this code to the PSPR first and execute from there, there is no difference in behavior.

If I use inline versions of the Set/ClearSafetyEndinit functions, there is no difference in behavior.

It appears something *else* must be done before you can erase or write to the Program Flash. Any one know what that is?

Thank you,

-Rob