stubs_entry_2.S
NHSTUB(time, 0x006B9180)
0xff86c2d8 is a different routine. From a simple disassembly, code above address 0xff8642f4 (start of "RAM code" in the below stubs_entry.S section) is relocated to a lower RAM address.
// Detected address ranges:
// ROM 0xff010000 - 0xffffffff (16711680 bytes)
// RAM code 0x006b1000 - 0x006e2d30 copied from 0xff8642f4 ( 204080 bytes)
// RAM data 0x00001900 - 0x000189bc copied from 0xff84d238 ( 94396 bytes)
... and Phil fixed the rest while I was writing this.