ICE debug communication fails

I have written a very small (64 instructions) monitor that communicates via the ICE comm channel with the host. This monitor is running in DMA memory (DMA is in test mode) because I don’t want to rely in external RAM. Everything seems to work fine until I want to get data back from the ICE comms data register - the core simply goes nuts. I have reduced the whole thing to this: -------------------------------------------------------------------------------------------------- LDC_R7 = 0xee107e10 /* ICE debug control to R7 / STD_R6 = 0xee016e10 / R6 to ICE debug write reg / start: __mov_r4,0xff<<24 __orr_r4,r4,0xb0<<16 __orr_r4,r4,0x20…/ R4: 0xffb00020 / getdata: __LDC_R7…/ get control reg / __tst_r7,2…/ write reg empty? / __bne_getdata __ldr_r6,[r4],#4…/ get next data with r4++ / __STD_R6 __nop __nop __nop __LDC_R7…/ get control reg */ loop: __b loop -------------------------------------------------------------------------------------------------- This works fine. I can catch the core if I place an endless loop immediately after reading the control register at the end. All registers are OK with the expected values. However, if I replace the last jump with a jump to getdata then the core goes into lala land. How can this happen? There is no debug request - the core is running. All ints are disabled. The DMA is disabled. There is no jump or reference to R15 that could go outside this loop of 10 instructions. Yet the PC is somewhere in the wild when I stop the core. I’m at a complete loss. Any ideas (timing of ICE debug, whatever …)? Mike