Maybe you should post such questions in a separate thread to get better coverage…
The CPU uses the LSB of the target address to know if it should switch to ARM or Thumb. 08064875 (odd address) is Thumb and will work. 2000fee0 (even address) is ARM and will cause a hard fault on Cortex.
You have to tell the compiler that pEntry() is a pointer to a (thumb) function. Not sure what your TMain type is.
If you are calling the buffer at an even address, it will freeze. But why it shows “70” instead of “7B” I am not sure. There might be some alignment issues here. Compiled code will be aligned on a 32-bit word boundary, with the address table entry of address+1. When you look up a 16-bit word at this (mis-aligned) address, it might not be so obvious what you see. My guess is that the “70” is from the following BX LR “47 70” opcode.
I find it confusing to dump the code in 16-bit chunks, and would prefer byte or 32-bit word dumps, knowing that the 4 bytes will be “backwards” due to LSB architecture. Try changing your debug dump prints to bytes instead.
Yes, tell the compiler and it will tweak the address LSB correctly.
EDIT: For these kinds of issues, stepping through the code with qemu is priceless:
http://www.seeedstudio.com/wiki/DSO_Nano/Qemu_gdb
EDIT2: I saw your TMain typedef now. The problem is that typecasting pEntry does not change the LSB. Try patching it manually with | 1.