I think I've restored the original behavior (stack pointer) and now hp700 boots again. According to old comments, SP used to points to the top (lowest) of argc/argv/env/aux/strings, not the bottom (highest). It'd be interesting to run a very old userland (ld.so) on a new kernel...