Hi,
I took a very quick look at this in Hatari by enabling the MMU state console in my program. I had previously only done this on a real Falcon.
It's now clear why the program crashes on exit - the stored CRP value is zero. This is the value it will try to put back on exit.
I'll need to look more closely to find out exactly how that can happen but the same value was nonzero on the real machine last time I tried this (and the code hasn't been touched since).
If it's interesting, the CRP value is stored like this, on startup:
lea sys_tt0,a0
pmove.l tt0,(a0)
lea sys_tt1,a0
pmove.l tt1,(a0)
lea sys_tc,a0
pmove.l tc,(a0)
lea sys_crp,a0
pmove.d crp,(a0)
; lea sys_srp,a0
; pmove.d srp,(a0)