As usual, the reason of this breakage is quite silly: in do_entIF, we
are checking for PS == 0 to see whether it was a kernel BUG() or
userspace trap.

It works, unless BUG() happens in interrupt - PS is not 0 in kernel mode
due to non-zero IPL, and the things get messed up horribly then.  In
this particular case it was BUG_ON(!irqs_disabled()) triggered in
run_posix_cpu_timers(), so we ended up shooting "current" with the
bursts of one SIGTRAP and three SIGILLs on every timer tick.  ;-)