Caterina USB bootloader executes SPM operations with interrupts enabled.

The sequence of writing to SPMCSR/SPMCR followed by the SPM instruction must occur within four MCU clock cycles or it will fail. Caterina appears to performing all SPM sequences with USB interrupts enabled. With the execption of block write sequences, Timer 1 interrupts are also enabled. If an interrupt occurs after writing SPMCSR/SPMCR and before the SPM instruction, the SPM operation will fail

These failures will be rare but they WILL happen. All of these sequences should be performed with global interrupts disabled.

Perhaps I missed something...but this certainly appears to be a problem.

Start by locating the Caterina USB bootloader code that performs the SPMCSR/SPMCR write followed by the SPM instruction. Review which interrupt sources are enabled during each SPM sequence; done means the four-cycle SPM window is protected from the interrupts identified in the issue, including the non-block-write cases.

Written by the indexing model from the issue text.