Thanks for the reference. I found the figure on chapter 27 bootloader support in the 48/88/168/328 doc. You are right. I think I mixed SRAM address with register in the front with FLASH address with bootloader in the back.
New question!
If I just copy a bootloader to the end of a a.HEX file, will I be able to program the atmega and boatload it in one shot, say with iscp header?