If $kernel_addr_r cannot be read, distro_efi_boot() falls back to address 0. This will lead to a segmentation fault on many systems.
distro_efi_read_bootflow_net() has a fallback to CONFIG_SYS_LOAD_ADDR and may have loaded to that address. Shouldn't we be consistent in what we program? Please, use a field in the bflow variable to indicate if and where an EFI binary has been loaded. Best regards Heinrich