Hi all, this bug was triggered by the 'crashme' program, which deliberately does various bad things. The problem occurs when _save_fp_context cannot write to the user stack. Since the fixup routine for this lacks a nop at the end, the following "random" instruction is executed (in my case it adjusted the stack pointer, which is pretty lethal). The patch below corrects this. Regards, Tommy S. Christensen, Eicon Networks --- r4k_fpu.S.orig Sun Dec 10 08:56:02 2000 +++ r4k_fpu.S Mon Apr 9 10:55:27 2001 @@ -94,6 +94,7 @@ ctc1 t0,fcr31 END(_restore_fp_context) + .set reorder .type fault@function .ent fault fault: li v0, -EFAULT