Thumb2 ADD/SUB can take SP as a destination register.