autobanking jump to XBP address instead of caller function during function return (large model)

Hi Keil,

i'm currently working on project involving large memory model, reentrant function with auto-banking. i've met this unresolved bug involving keil stack frame causing my program flow generate an error.

the error generated when a callee function return to it's caller, instead of returning to it's caller address my program jump to current XBP value (lets say current XBP value at X:0xD00), then my program jump to that address (C:0xD00), that address already occupied by other piece of code, and execute that code causing my program running indeterminately. i've debugged the code and the returning address should be passed on to DPTR by ADDXBP function before calling SWITCH_BANK, the DPTR contain 0xD00 by the time SWITCH_BANK is called.

here's several questions regarding C51 that would help the debugging process:
1. i want to know where do keil save it's caller program counter for large reentrant model? my program might overwrite that area (in my case all function always set as reentrant).
2. what happened to stack frame when reentrant function called? program counter and local reentrant variable/argument is on different stack or same stack? stack frame structure if available would help a lot.
3. beside during function return when will XBP accessed? i believe my error caused by wrong access of XBP.

i use c51 compiler and lx51 linker, uVision3

Sincerely,
Agus Purwanto