ARM720T processors use the "late" abort option, which means we have to
correct the base address of any page fault ourselves.  However, we
were mis-correcting the thumb "push" instruction, causing the retried
instruction to fail in a spectacular way.