Invalid POPed return address after SVC call

Question

I am working on the ARM Cortex-A5 core for a custom processor and get a really strange problem that seems inexplicable from the point of view of SW. The problem is that at some point when the system is under stress testing (rebooting hundreds of times), sometimes Prefetch is interrupted when it returns from an SVC call. Calls are made as follows:

User Mode Code:

;...Stuff
    BL       foo
;.. Stuff.

foo
    PUSH     {r4,lr}
    SVC      #0x1a 
    POP      {r4,pc}

SVC handler:

SVC_Handler
    PUSH     {r0-r12,lr}
    ;... Do stuff
    POP      {r0-r12,lr}
    SUBS     pc,lr,#0

, LR_USR BL foo, IFAR 0, r4. , LR_ABT 0x4, , . , , POP {r4,pc} , , , , ( SP_USR). , , pop, POP .

, . SVC .

SW , , ( /??). - - ? , . (, Heisenbug...)