There is more than one spot in boot_loader_epcs_bits_sii_siii_ciii.S that has addresses assuming the base address is zero. If you search the file for "sub_epcs_open_address" you should be able to find each spot. For example, there are also direct references to address 48 and 33. I think you also need to add in your offset to the resulting length before the final open.
I have never actually tried to modify the boot loader this way so I may have missed a required stop in the above description. Instead, I put my software at a fixed address (not immediately after the .sof) and modified the boot loader to just always use this address.