now I'm more confused

https://gnu.googlesource.com/gcc/+/refs/heads/devel/analyzer/libgcc/config/arm/cmse_nonsecure_call.S

This is GCC's library function for doing the BXNS instruction (and clearing a bunch of registers).

r4 contains the address to jump to.

So why are they copying it to all the other registers, and also copying it to the flags register? Did someone get confused and think that r4 contains zero??