Whatever register is copied has to be one of the "type b" ones - ESP, EBP, ESI or EDI. Only ESP is special enough for the hardware to have that direct path for

Whatever register is copied has to be one of the "type b" ones - ESP, EBP, ESI or EDI. Only ESP is special enough for the hardware to have that direct path for it. Maybe it's not (just) for privilege transitions, but automatically saving the value of ESP at the start of every instruction, so that it can be "rolled back" when there is a stack limit violation?