All, I think that the issue I pointed out the list is not a QEMU bug at all but a GDB bug. GDB's sparc software single step implementation seems to be what is stuck. It always re-sets the breakpoint at the current instruction in this case. It calculates the breakpoint offsets by analyzing the instruction and doesn't take this edge case into account. It does not appear to receive an invalid npc value from QEMU as I thought it was.
Steven