* The LR (which I understand is the return address) points, I guess, to the 27c56 line immediately following the memcpy call.  Is it possible memcpy does crazy magic that runs code from RAM?

```
   27c4e: 4632          mov     r2, r6
   27c50: 4420          add     r0, r4
   27c52: f000 fabc     bl      0x281ce <__aeabi_memcpy> @ imm = #0x578
   27c56: 19a0          adds    r0, r4, r6
   27c58: 60a8          str     r0, [r5, #0x8]
   27c5a: f85d 8b04     ldr     r8, [sp], #4
   27c5e: bdf0          pop     {r4, r5, r6, r7, pc}
```