Extracting faulting address on Cortex-M3

I'm trying to display information on my LCD in the fault handler.  I'm 
mostly interested in the address of the code that caused it, or close to 
it.  BFAR rarely gives me a valid address.

I've planted identical bugs in my code, but in multiple locations which 
I can trigger individually.  I try writing to 0x3000000, which is an 
invalid address and always causes a fault as expected, but the 
hardfault_args pointer (see code below) sometimes needs to be 
incremented by one word to land on the correct set of pushed registers 
(r0-r3, r12, LR, PC, xPSR).  hardfault_args will point to the correct 
address in the stack when some bugs are triggered, but other bugs will 
cause hardfault_args to be one word too small.  It's perfectly 
repeatable.  I'm not using an RTOS.

I've tried incrementing hardfault_args when it isn't divisible by 8. 
I've also tried setting STKALIGN in the NVIC.  Initially I thought this 
worked, but I was testing it on a slightly different CM3 micro 
(LM3S6965) with slightly different code, but same core. Now I'm trying 
it on a LM3S9B00 chip and one of the artificial bugs is still causing 
hardfault_args to be offset by one word; this bug is even in the same 
function, but different location, than another which gives good results 
(each of these bugs is in a completely different area and triggered 
individually) This is driving me nuts.

Any ideas?


Here's what I'm using (GCC):

static void IntDefaultHandler(void)
{
  __asm(  "TST LR, #4\n"
        "ITE EQ\n"
        "MRSEQ R0, MSP\n"
        "MRSNE R0, PSP\n"
        "B hard_fault_handler_c\n");
}

void hard_fault_handler_c(unsigned int * hardfault_args)
{
//display hardfault_args[0], hardfault_args[1],...hardfault_args[7]
}