So even with turning on all Errata workarounds, disabling the D-cache and I-cache, and disabling branch prediction the problem still occurs. I also confirmed that at the end of sys_rt_sigreturn(), the T bit in regs->ARM_cpsr is NEVER set. --david