Image load failure

Hello,

I have this scatter file

LR_IROM1 APPLICATION_START_ADDRESS APPLICATION_IMAGE_MAX_SIZE  {    ; load region size_region

  ER_IROM1 APPLICATION_START_ADDRESS RESET_VECTOR_AND_KERNEL_SIZE  {  ; load address = execution address
   *.o (RESET, +First)
   *(InRoot$$Sections)
   *(privileged_functions)
   .ANY (+RO)
  }

  ER_IROM2 (APPLICATION_START_ADDRESS + RESET_VECTOR_AND_KERNEL_SIZE) (APPLICATION_IMAGE_MAX_SIZE - RESET_VECTOR_AND_KERNEL_SIZE)  {
    .ANY (+RO)
  }

where

#define PBOOT_START_ADDRESS             (0x0)
#define MBOOT_START_ADDRESS             (PBOOT_START_ADDRESS + PBOOT_IMAGE_MAX_SIZE)
#define APPLICATION_START_ADDRESS       (MBOOT_START_ADDRESS + MBOOT_IMAGE_MAX_SIZE)

#define RESET_VECTOR_AND_KERNEL_SIZE    (0x4000)

#define INTERNAL_FLASH_MAX_SIZE         (0x80000)
#define PBOOT_IMAGE_MAX_SIZE            (0x1000)
#define MBOOT_IMAGE_MAX_SIZE            (0x4000)
#define APPLICATION_IMAGE_MAX_SIZE      (INTERNAL_FLASH_MAX_SIZE - PBOOT_IMAGE_MAX_SIZE - MBOOT_IMAGE_MAX_SIZE)

and my LPC1788 ends up in a hard fault, after attempting to load the address of SystemInit, here:

Reset_Handler      PROC
                                EXPORT  Reset_Handler             [WEAK]
                                IMPORT  SystemInit
                                IMPORT  __main

                                LDR     R0, =SystemInit
                                BLX     R0

But if I remove ER_IROM2 - scatter loading works and the controller starts up.
Am I hitting a linker limitation here? Any ideas?
I must place my kernel image at the beginning of flash (via the section "privileged_functions").