Random Crashes / corruptions when using simple ucode

[HailToDodongo]

When using an overlay together with either OpenGL or tiny3d it seems to sometimes and randomly crash the game. This only happens on hardware, and is sensitive to the code on the CPU side as well as in IMEM.

Here is it replicated in the gldemo. I had to pull back the camera in the demo to make the RDP faster to trigger it more often it seems.

+DEFINE_RSP_UCODE(rsp_fx);
+static int rspIdFX;
+  
@@ -158,6 +161,7 @@ void render()
     glClear(GL_COLOR_BUFFER_BIT | GL_DEPTH_BUFFER_BIT);
 
     glMatrixMode(GL_MODELVIEW);
+    camera.distance = 10000;
     camera_transform(&camera);
 
     float rotation = animation * 0.5f;
@@ -189,6 +193,8 @@ void render()
     glEnable(GL_RDPQ_TEXTURING_N64);
     glEnable(GL_RDPQ_MATERIAL_N64);
 
+    rspq_write(rspIdFX, 0);
+
@@ -240,6 +248,8 @@ int main()
     rdpq_init();
     gl_init();
+    rspIdFX = rspq_overlay_register(&rsp_fx);

And the ucode (not even writing to the entire buffer here). The exact value and how much of the buffer i fill seems to be important. Not writing into the buffer seems to avoid a crash.

#include <rsp_queue.inc>

.data
  RSPQ_BeginOverlayHeader
    RSPQ_DefineCommand TestCrash, 4
  RSPQ_EndOverlayHeader

  RSPQ_BeginSavedState
    STATE_MEM_START:
    .align 4
    DATA: .ds.b 2560
    .align 4
    DUMMY: .ds.b 800
    STATE_MEM_END:
  RSPQ_EndSavedState

.text

TestCrash:
  vsubc $v28, $v00, $v30.e7 # 0xFFFF
  ori s7, zero, %lo(DATA)
  addiu s5, s7, (16*120)
  LABEL_0001:
  beq s7, s5, RSPQ_Loop
  nop
  sqv $v28, 0, 0, s7
  j LABEL_0001
  addiu s7, s7, 16

The crash i get, seems to be random and can happen after a few frames or seconds, sometimes never. This can include NPE, floating exceptions, RSP crashes or just black screens. It also doesn't matter if RSPQ_PROFILE is enabled or not. The only thing i can sometimes see in ares is a RSP DMA writing to RDRAM warning.