diff --git a/core/embed/bootloader/main.c b/core/embed/bootloader/main.c
index 99ce69171..180bef943 100644
--- a/core/embed/bootloader/main.c
+++ b/core/embed/bootloader/main.c
@@ -353,6 +353,7 @@ void real_jump_to_firmware(void) {
     ui_screen_boot_stage_1(false);
   }
 
+  display_finish_actions();
   ensure_compatible_settings();
 
   // mpu_config_firmware();
@@ -364,6 +365,7 @@ void real_jump_to_firmware(void) {
 
 #ifdef STM32U5
 __attribute__((noreturn)) void jump_to_fw_through_reset(void) {
+  display_finish_actions();
   display_fade(display_backlight(-1), 0, 200);
 
   __disable_irq();
diff --git a/core/embed/trezorhal/stm32f4/common.c b/core/embed/trezorhal/stm32f4/common.c
index ec1cd0e6a..1c6d48f76 100644
--- a/core/embed/trezorhal/stm32f4/common.c
+++ b/core/embed/trezorhal/stm32f4/common.c
@@ -218,7 +218,6 @@ void collect_hw_entropy(void) {
 // which might be incompatible with the other layers older versions,
 // where this setting might be unknown
 void ensure_compatible_settings(void) {
-  display_finish_actions();
 #ifdef TREZOR_MODEL_T
   display_set_big_endian();
   display_orientation(0);
diff --git a/core/embed/trezorhal/stm32f4/supervise.c b/core/embed/trezorhal/stm32f4/supervise.c
index c1ea8f75a..d4a72df17 100644
--- a/core/embed/trezorhal/stm32f4/supervise.c
+++ b/core/embed/trezorhal/stm32f4/supervise.c
@@ -4,6 +4,7 @@
 
 #include "../mpu.h"
 #include "common.h"
+#include "display.h"
 #include "supervise.h"
 
 #ifdef ARM_USER_MODE
@@ -28,6 +29,7 @@ __attribute__((noreturn)) static void _reboot_to_bootloader(
 #endif
 
 void svc_reboot_to_bootloader(void) {
+  display_finish_actions();
   boot_command_t boot_command = bootargs_get_command();
   if (is_mode_unprivileged() && !is_mode_handler()) {
     register uint32_t r0 __asm__("r0") = boot_command;
@@ -67,8 +69,12 @@ void SVC_C_Handler(uint32_t *stack) {
       __asm__ volatile("msr control, %0" ::"r"(0x0));
       __asm__ volatile("isb");
 
+      // The input stack[0] argument comes from R0 saved when SVC was called
+      // from svc_reboot_to_bootloader. The __asm__ directive expects address as
+      // argument, hence the & in front of it, otherwise it would try
+      // to dereference the value and fault
       __asm__ volatile(
-          "mov r0, %[boot_command]" ::[boot_command] "r"(stack[0]));
+          "mov r0, %[boot_command]" ::[boot_command] "r"(&stack[0]));
 
       // See stack layout in
       // https://developer.arm.com/documentation/ka004005/latest We are changing
diff --git a/core/embed/trezorhal/stm32u5/common.c b/core/embed/trezorhal/stm32u5/common.c
index 9dc711458..647000509 100644
--- a/core/embed/trezorhal/stm32u5/common.c
+++ b/core/embed/trezorhal/stm32u5/common.c
@@ -200,7 +200,7 @@ void collect_hw_entropy(void) {
 // this function resets settings changed in one layer (bootloader/firmware),
 // which might be incompatible with the other layers older versions,
 // where this setting might be unknown
-void ensure_compatible_settings(void) { display_finish_actions(); }
+void ensure_compatible_settings(void) {}
 
 void show_wipe_code_screen(void) {
   error_uni("WIPE CODE ENTERED", "All data has been erased from the device",