Caterina USB bootloader executes SPM operations with interrupts enabled.

[aweatherguy]

The sequence of writing to SPMCSR/SPMCR followed by the SPM instruction must occur within four MCU clock cycles or it will fail. Caterina appears to performing all SPM sequences with USB interrupts enabled. With the execption of block write sequences, Timer 1 interrupts are also enabled. If an interrupt occurs after writing SPMCSR/SPMCR and before the SPM instruction, the SPM operation will fail

These failures will be rare but they WILL happen. All of these sequences should be performed with global interrupts disabled.

Perhaps I missed something...but this certainly appears to be a problem.

[NicoHood]

I remember I had those rarely fails over time. Might be the reason.