Illegal pop instruction output in arm32

[Rosayxy]

When I was doing a ctf chall lately, I tried to run ROPgadget with the following command ROPgadget --binary sp33d5 --only "pop|ret"|grep r0.
The output is as below

The output contains pop instructions that pops the sp register, but these instructions are invalid, according to this documentation, which states that "ARM POP instructions cannot have SP but can have PC in the reglist".

When such a gadget is used in a ropchain, the system will give an error of "illegal instruction" and result in sending a sigkill signal.

Thanks in advance for looking into this. Please let me know if I can provide any additional information or assist with fixing this issue.

[SweetVishnya]

In order to disassemble instructions we use capstone that decodes it as a valid instruction. You may try reporting this bug directly to capstone.

[Rosayxy]

I will try this. Thanks for your time!