That behaviour is actually documented though? It seems to be a corner case that OS developers didn't pay attention to until it was exploited. It goes all the w

That behaviour is actually documented though? It seems to be a corner case that OS developers didn't pay attention to until it was exploited. It goes all the way back to 1980, where a revision to the 8086 introduced this to prevent an exception or non-maskable interrupt from using an incorrect stack pointer (by making MOV SS / POP SS atomic with the next instruction, which must load SP). Arguably it should no longer be necessary in ring 3 protected mode, since the stack will be switched automatically - unless the handler itself was in ring 3, but no current OS allows that?