Hi,
Hope you have found and corrected the bug. If not, I think you will find this helpful. I am listing one reason for such a bug to occur. I'm not sure if there are more. As per my understanding, this can be caused when the XSM machine uses the page allocated for console interrupt (page 8) as the kernel stack. Thus, overwriting its contents when doing a "PUSH". This can happen in 2 cases (I experienced these 2, there could be more):
1. When you don't change the stack from user stack to kernel stack upon entering any interrupt. This means that SP is still pointing to some address between 4096 and 9*512-1, which in kernel mode, is the address within the console interrupt.
2. When you have cleared the page table initialisation and process table initialisation of a process and accidentally forgot to set its STATE to TERMINATED (PID=2 in my case). The explanation to this is something which I don't understand now but this was a cause.
You could check these 2, although I'm not sure whether these could be the only reasons for that bug to occur.