I will try it shortly.
I have the impression you can't touch the area 0x3c000-0x3ffff, which is strange, because it's only used for user config. That is why I suggested using an alternate region+section that starts at 0x40000 so this area is left untouched. It would, I guess, need an simple change in esptool.py so it creates three firmare image files instead of two.
I will also try the -f options, maybe I am already running into unreachable calls, maybe that's the problem.