8051 - SW FW / APROM of N76E003

Two questions on my working on N76E003

1. When I write data in APROM by using IAP, The code size is 9000 bytes and I set my flash_data_address after this 9000 bytes.

But the interference was happened on my code. I am not sure I select the address for writing data in APROM is correct.

2. How to know my code starting and ending address in APROM?

In one of my code, I set flsh_data_adreess 0x4700, although n76e003 have only 18Kb memory and its last location is 0x4650, but it still that working.

I don't know why the issue happened?