From memory (sorry), the upper mapped addresses such as $ff8240 were assembled as this or (as they should be) as $ffff8240.
Even if they were only encoded as $00ffxxxx then this is above 16Mb yes?
I think this could also explaine why some progs had problems as addresses were assembled as $00ff8240. This is an actual address in memory if you have lots of it. Just a theory.