If you configure the part for an external reset input (a bit in UCFG1 flash memory) then this is not an issue. I will go out on a limb here and suggest that there are other parts in the industry that have similar potential issues (bad reset) if they have power-on detect and brownout detect circuits. A careful read of others datasheets will detect this. The problem is that when Vdd falls, you trip the brownout detect and hold the part in reset.Since most brownout detect circuits are based on band-gap voltage references, there is a minimum operating voltage needed for the bandgap and brownout detect circuits. As Vdd continues to fall, there will be a point when the brownout detect stops working.As long as Vdd drops below 0.2V when you shut off power, you're fine. When you go back up, you'll get a power-on reset. But, I realize that in a lot of systems, that doesn't always happen. We did some things in the bootcode to help with this issue. We modified the first instructions in the ISP and IAP code areas so that if you "walked up into them" (started fetching instructions from the first location) you executed a software reset of the device. We added a permission token (foir lack of a better term) to the IAP code so that the IAP function request has to be set up by the rountine that called it. On later devices, we modified the hardware to also require a token. Note that these issues only apply to devices with ISP/IAP capability. It has never been an issue with ICP devices.