Ferschlugginer AGROS bug remains elusive, but is definitely timing-related.
Like maybe interrupt disable isn't working...? Or leaves an instruction or two exposed after I think interrupts ought to be disabled?
My semaphores seem (under certain circumstances) to be getting into implausible states. And, on at least one occasion, the observed behavior was consistent with P having been interrupted after reading the counter, at which time interrupts are supposed to be disabled. (No, I'm not using the magic incantation for a multiprocessor lock. Not on an ARM7 MCU. The semaphore data structure accommodates such locks, for architectures that might be multiprocessorized, but implementing them here would be pointless and waste CPU cycles.)
Update: definitely a race condition. If I change the clock speed of the SPI bus, or insert a delay between launching the SPI-bus operation and waiting on the completion semaphore, the weirdness goes away. Ergo, in the specific case at hand, V (actually Vc, which is safe to call from interrupt handlers) must be happening partway through P. Which is supposed to be impossible, what with a single processor and interrupts (theoretically) disabled.