Concerning the 16 first dwords of flash returning "garbage":
There's a register on LPC24xx (and LPC23xx which I'm currently working with) called "MEMMAP", it's at 0xe01FC040 and it's the Memory Mapping Control Register. And if you read an address from 0x00000000 - 0x00000003f, what you actually see depends on the content of this MEMMAP register. It's done that way so you can redirect interrupts to a convenient location when not running from flash (which is physically mapped there).
If MEMMAP == 00 (bits), then bootloader-mode is active. The bootloader is at 0x7fffe000, and hence the first 16dwords are read from physical address 0x7fffe000-0x7fffe03f. That's because the bootloader (in masked-rom) wants to have control over what's being run when an interrupt occurs.
If MEMMAP == 01, then you are in user-flash mode. User flash starts at 0x00000000 and so the first 16 dwords are not visibly remapped, they correspond to the first 16 dwords in user-flash.
If MEMMAP == 10, then the first 16 dwords read are the first 16 dwords of internal RAM at 0x40000000, in case you want to dynamically change the interrupt vectors.
If MEMMAP == 11, then the first 16 dwoards are mapped to external memory busses available on some devices.
Why is it 16 dwords, and not only 8? A branch (=jump) on ARM can only directly reach an address in the range of +/-24bit around the current executing address. If you want to jump further, you will have to store the actual address *somewhere *, and this most often is the next 8 dwords after the instruction put in the interrupt table area.