In the CSEL Rd,Rm,Rn instruction family (also including CSINC, CSINV
and CSNEG), the architecture lists it as CONSTRAINED UNPREDICTABLE
(i.e. SoftFail) to use SP in the Rd or Rm slot, but outright illegal
to use it in the Rn slot, not least because some encodings of that
form are used by MVE instructions such as UQRSHLL.
MC was treating all three slots the same, as SoftFail. So the only
reason UQRSHLL was disassembled correctly at all was because the MVE
decode table is separate from the Thumb2 one and takes priority; if
you turned off MVE, then encodings such as [0x5f,0xea,0x0d,0x83]
would disassemble as spurious CSELs.
Fixed by inventing another version of the GPRwithZR register class,
which disallows SP completely instead of just SoftFailing it.