We have a test software that deliberately test a BusFault scenario. The exception service routine is called as expected but when the flow is returned back to the program it breaks. For some unkown reason R7 register gets a new value during the EXC_RETURN, bx LR.From what I see, R7 should not be touched by the core during exception return.
Note, this is seen when running a simulated M7 with ARM FastModels 11.26