Using the macro traceTASK_SWITCHED_OUT, I wonder if it is easily possible to figure out which instruction a switched-out task is about to return to the next time it is switched in (without hacking the kernel…)?
The task return address will always be locate-able, but how it is located is very dependent on the port you are using. In some ports it will be at an offset form the stack pointer when traceTASK_SWITCHED_OUT is called, and in other ports it will be at an offset from an alternative stack pointer value.