Reading OTP: wrong results depending on clock speed

Yes, JALR definitely should end with 0x67, so the documentation for location 0x21FFC is incorrect.
0x57 is a reserved major opcode.