1. Thanks to Bert Sesam your comments helped. I have a working loader now..

2. There is no need to first an erase flash, since the write code page does automatically erase the actual bytes it rewrites.

3. I received this from ATMEL support in France, saying, that only 16 bytes at a time can be programmed from the API:

>> I am sorry to inform you of the following problems
regarding the api_wr_code_page function :
Due to Product problems :
1- a Bug limits to 16 bytes the number of Datas which
can be written at the same time. So to write a 128 bytes
page, you must call 8 times the function with the good
start address.
Else, the first Read is not functional (or the fetched code
is bad).
This bug is only applicable for ISP from User Flash and not
when the Boot is done in the Bootloader for UART ISP.
Remark :
One constraint specified in the ISP documents requires
that all the address must be within the same 128 bytes page
(you cannot cross a page boundary).
2-
Moreover, there is a bug in the Bootloader :
When the flash api “__api_wr_code_page” is called with the
field nb_data equal 0, then 255 data are wrote in flash.


The change of the 1.4.0 Bootloader you mention is only the
Command frame used for the UART ISP command frames.
The 1.1.2 bootloader is only able to receive 16 Data bytes in
the command frame.
The 1.4.0 can receive 128 Data bytes in the same command.