Comment 2 for bug 1996610

to reproduce:
make a secure -> non-secure call like:

typedef int __attribute__((cmse_nonsecure_call)) non_sec_func(void);
e.g:
 non_sec_func *non_sec_reset;
 uint32_t *vt_ns;

 vt_ns = (uint32_t *)SCB_NS->VTOR;
 __TZ_set_MSP_NS(vt_ns[0]);
 non_sec_reset = (non_sec_func *)(vt_ns[1]);
 non_sec_reset();
placed in memory with a big offset to the entry function (vt_ns[1]) (in my case it was off by 0x08000000)
with proper SAU_config etc. any initial secure -> non secure example shall be ok
please don't forget to compile with -mthumb!
I hope thats enough information to reproduce this issue, if not please let me know in detail what else you need,
BR
Hans