As per ACLIC spec (Version v0.17), we perform following sequence (in order) on interrupt entry when Smip/Ssip extensions present:

• Save registers x10-x15 (these are the caller saved registers available in RVC)
• Adjusts the stack pointer to create the stack frame
• Conditionally performs a stack pointer swap by executing cspspush sp

So, if we have S or U modes, we'll save registers on memory location which is pointed by S/U-mode x2. It can be

• stack of lower privilege mode which we don't have access to
• stack of lower privilege mode which we can overflow
• SP (x2) register which is not initialized properly and points to random memory
• x2 which is not used as SP at all

How is it supposed to work at all?