I've fallen a little behind in my reading
so I forgot to follow this thread.
I now favour the "executing out of prefetch
buffer" theory, reinforced
by the following comment snippet someone sent me, supposedly
taken from
the source to MicroVAX console ROMs:
; To turn on MMGT and execute the following REI depends
on a "quirk"
; of the MicroVAX chip. Namely, if the MTPR and REI
instruction are
; both fetched as part of the same instruction
prefetch, then the
; REI will be executed regardless of the enabling of
mmgt. However,
OK. So it sounds like you have strong evidence for
a chip bug here. The chances of getting it confirmed
are slim :-) - there was a list of Waivers granted
to various VAX implementations, but seeing it was
on a need-to-know basis. If the console code has
such comments in, it's best to believe them.
I guess they let the bug pass both because it's
relatively harmless and would have been expensive
to fix once the chip had been finalised.