How can you be using the SPI interrupt in the bootloader, when the interrupt vector address is in SDRAM - where you are loading the code to.
I'd have thought you'd need to run the boot loader with interrupts disabled (polling for status).
Also, where is your bootloader's stack (if the code actually uses one). If that is in SDRAM you might be writing over the stack.
It ought to be possible to write a bootloader (in C) that has almost no memory accesses. I couldn't stop the function prologue saving registers - they are the only references to %sp in my entire hdlc and mtp2 engines.
(gcc would need a rebuild to let me use %sp as a general register!)