built from git source at 8202074 on Linux

I am using SAMD21, I have a modified Arduino Zero bootloader in the first 8k, with BOOTPROT fuse set to cover first 8k:

0xFFFFFC5DD8E0C78A

After starting the bootloader, I run the bossa GUI.

If I set the 'erase all' option (no offset) and click 'write' then sometimes I get:

After the fail, bootloader is corrupted and all fuses are set to 1:
NVMUSERROW: 0xFFFFFFFFFFFFFFFF

I can recover by re-flashing bootloader and re-setting fuses with openocd and Atmel ICE programmer. But the reserved bits of the fuses are now always set to 1 and can't be changed:
NVMUSERROW: 0xFFFFFE5DD9FEC78A

I can repeat the exact same steps, but this time the write succeeds:

the bootloader and fuses remain intact.

It's difficult to say, but it seems maybe 1 in 20 times this will happen. Obviously I'd like to prevent it!

I don't know enough about SAM-BA - is it possible for SAM-BA to change fuses? I thought not.
I'm definitely open to the idea that this is a problem with the bootloader, perhaps overwriting itself and the fuses. But it is very close to the official Arduino Zero bootloader.