Hardfault error on callback

Hi,

I'm trying to figure out why a registered callback function is failing.

C:
socket->cb.socket(socket_idx, 0);

ASM:
It fails at:

00415B88   ldr    r3, [r4, #60]        
00415B8A   mov    r1, r11        
00415B8C   mov    r0, r6        
-> 00415B8E   blx    r3        
00415B90   b    #-676


Register r3: 0x00422091

The function it is suppose to jump to is at 0x00422090. So why this extra bit? And why does it get unaligned?

Thanks in advance.