I found this problem on a MIPS machine.  The problem is 
likely to happen on other register-rich RISC arches too.

cmdcnt needs to be volatile since it is modified by
irq routine and read by normal process context.

Jun