Funny PABT behaviour - why?

I came across a weird behaviour when trying out my program on Raspberry Pi 2b (Cortex-A7):

When I try my PABT-handler using BKPT, the handler is entered fine, but on return the program restarts.

The restarted program returns fine from the BKPT and continues as expected.

Any idea what could cause the restart once?

I have MMUs, caches and predictors off, so the memory should be strongly ordered?

And anyway, it's the same code.

void rpi2_pabt_handler() __attribute__ ((naked));

...

void rpi2_pabt_handler()
{
   asm volatile (

         "push {r0 - r12, lr}\n\t"
         "mov r5, lr\n\t"
         "bl rpi2_pabt_handler2\n\t"
         "pop {r0 - r12, lr}\n\t"
         "subs pc, lr, #0 @ to skip bkpt\n\t"
   );
}

#define DEBUG_PABT
void rpi2_pabt_handler2()
{
   uint32_t exc_addr;
   uint32_t exc_cpsr;

#ifdef DEBUG_PABT
   int i;
   char *pp;
   static char scratchpad[16];
#endif

   asm volatile
   (
         "mov %[var_reg], r5\n\t"
         :[var_reg] "=r" (exc_addr) ::
   );
   asm volatile
   (
         "mrs %[var_reg], spsr\n\t"
         :[var_reg] "=r" (exc_cpsr) ::
   );

#ifdef DEBUG_PABT
   pp = "\r\nPABT EXCEPTION\r\n";
   do {i = serial_raw_puts(pp); pp += i;} while (i);

   serial_raw_puts("exc_addr: ");
   util_word_to_hex(scratchpad, exc_addr);
   serial_raw_puts(scratchpad);
   serial_raw_puts("\r\nSPSR: ");
   util_word_to_hex(scratchpad, exc_cpsr);
   serial_raw_puts(scratchpad);
   serial_raw_puts("\r\n");
#endif

   // rpi2_trap_handler();
}