Have you initialized the SVC mode, and is the NS-bit configured as secure before you call cps?
My best guess is that you've got the NS-bit set to 1 (i.e. non-secure) and you switch modes, which drops the core in to non-secure SVC mode, because the NS-bit takes effect as soon as you drop out of monitor mode. It is quite possible that the PC you are using doesn't exist in the non-secure world, so it faults, but the non-secure exception table is also not set up, so that faults. Infinite loop of faults = hung CPU.