Due to the unfortunate way the bug could only be triggered when reading SPRG[0-3] into a register lower than %r4 with the "mfsprg %rX, 0" syntax, the tests did not detect it.
(It could not be triggered for "mfsprg0, %r2" because that pattern was already in the table, so the earlier "correct" match took effect)
As a canary, add an intentionally ambiguous "mfsprg 2, 2" and "mtsprg 2, 2" check that would have caught the problem.
I think it's better to use mtsprg 2, %r2。