esp8266 nonos flash map and blank.bin

[me@esp32]

Until recently, I was flashing my NONOS program and a .bin file of my data onto ESP01 with 1M memory. The original upload procedure was writing blank.bin at 0xfe000, but I modified the procedure to write my own .bin data at 0xfe000. My program ran as intended until I tried loading it onto another ESP01. According to user_rf_cal_sector_set, the size_map = 2, and rf_cal_sec = 251.

Everything works fine if I load blank.bin at 0xfe000. (Actually, it's not blank -- it's 0xff)

I dumped the 4K of flash from 0xfe000 and I noticed that the SSID and password were stored in that block as well as some other data.

I have 2 questions that I hope someone can answer:
(1) why did everything work fine on my old ESP01, but not work when I loaded onto another ESP01?
(2) if 0xfe000 is not available for use, what address can I use to store my data?

Thanks.