How do you find out what the I-cache content is? Doing an LDR rn, [lr, -4] in the undef handler is going to read the data cache not the instruction cache.If the instruction fetch sometimes returns bad data then you might see symptoms like this -- but I'd expect more problems than just undef instructions at one location.Is the code that is undeffing being loaded/modified?