[NevynUK]

arm_ldr_imm and arm_str_imm in thumb-codegen.h chose the 16-bit LDR/STR (immediate) encoding for low registers whenever imm < 128 and imm % 4 == 0, but never checked imm >= 0. That encoding takes only an unsigned word offset (0-124), so negative offsets were emitted as large positive ones. The byte and halfword variants already have the check; this adds it to the word variants.

How it showed up

Under --interp, a GC stress app on a Meadow F7 (CCM) locked the core in a double fault: the Mono main thread's SP had become 0. I dumped the interp-to-native trampoline from SDRAM and disassembled it:

str   r1, [r7, #124]     <- ARM_STR_IMM (code, ARMREG_R1, fp_reg, -4)
str   r0, [r7, #120]     <- ARM_STR_IMM (code, ARMREG_R0, fp_reg, -8)
ldr.w ip, [r7, #-4]      (high destination register, so already 32-bit and correct)

On every P/Invoke and icall from interpreted code, the trampoline overwrote its caller's frame (saved registers and frame pointers) and called through uninitialised slots. JIT-compiled code doesn't use this trampoline, but any negative-offset low-register LDR/STR the JIT emitted was affected in the same way.

Testing (CCM, Meadow.OS Phase4 / WildernessLabs/Meadow.OS#697)

• GC stress under --interp: 5 passes in 229 s, no failures. Before the fix, the first test never completed.
• GC stress under JIT (--debug), as a regression check: 30/30 tests pass in 121 s.

🤖 Generated with Claude Code