`top_of_stack` isn't aligned down to the previous 16 byte aligned address. Furthermore, `top_of_stack` as well as `XT_CP_SIZE` are used unaligned in `cpu/esp_common/vendor/xtensa/portasm.S` in the address computation for the coprocessor save area, .
Aligning pointer `p` down to the previous 16 byte aligned address results in a wrong address of the coprocessor save area during the initialization of the thread context. This leads to wrong values and wrong positions of these values in the coprocessor save area in inital thread context.
Since ESP8266 doesn't have a coprocessor, this bug affects only ESP32.
The problem seemed to be a pipelining problem of write and read instructions when swapping the context. An isync instruction when returning from a context switch solves the potential pipelining problem.
Reason for the problem was that tast_exit function in thread_arch.c tried to release the thread a second time although it was already released in sched_task_exit. A simple check whether the thread is already released (sched_active_thread == NULL) solved the problem.