Thanks @michael-petch
The issue was likely CX for retries and AX for ES. Using SI for retries kept CX free, and BX for ES avoided overwrites. These tweaks fixed the bootloader!