callee-save floating point registers break frame pointer
When callee-save floating point registers are saved in a function prologue, the emitted code gets confused about where the frame pointer is. Specifically, it moves csp into c29 when csp is pointing into the saved floating point register area. See https://cheri-compiler-explorer.cl.cam.ac.uk/z/dvfM9s for an example.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information