This resulted in an out-of-bounds array access, since sr is only 16 entries long and SPR_IBAT0U evaluates to 528.