I just wrote down what Nut/OS did and in which order.

{}: init by avr-libc
[]: own added code

defines:
NUTMEM_END 0x10FF (4351)
__heap_start 0x19f
NUTXMEM_START 0x1500
NUTXMEM_SIZE 26000
NUTMEM_SIZE 4096
NUTMEM_START 0x100

init1:
  NutCustomInit:
    Waitstate settings of XMEM
      MCUCR, XMCRA, XMCRB
    Baudrate settings
  (Fake Nic Eeprom)
  NutInitXRAM
    MCUCR
  [Watchdog init]
  [Send "BOOT" over the serial port]
  [remembers last active thread name pointer]

init2:
  {stack init}

init4:
  {copies data from flash to sram}

init5:
  NutInitSP:
    Stack pointer init -> end of xmem
  NutInitHeap:
    NutHeapAdd

init6:
  [print last active thread (if any) over the serial port]

init8:
  NutInit:
    NutCustomInit
    NutInitHeap
    NutLoadConfig
    NutThreadCreate
  [Watchdog reset]