I think I found the bug in empeg_therm.S.

All of the loops inside those assembly routines are very careful to do "blt" when comparing timers while waiting for things.. all loops except one, that is. It uses "bne" instead, and if it gets "lucky" it may miss the timer roll-over. So I have changed it to "blt" like the others, and we'll see if that fixes the problem (appears to for me, anyway).

If it remains stable here, I'll grind out v23 of my patches shortly, with the thermometer reading reinstated.

-ml