The issue might be that with dual spi flash, the address you pass to erase the chip is half the address you access it with (1800_0000). The reason is that in spi mode, each api flash address holds 2 bytes. So then in xip mode, even asdresses are in api flash 0, and odd addresses are in spi flash 1.
This would mean xip addresses 1A00_0000 and 1A00_0001 are really spi address 0100_0000 (2 byte read...because each api address holds 2 bytes, not just 1...so xip address increment twice as fast as spi addresses.