This should not happen. Generally, on hardware where interrupt enable/disable is implemented by setting the priority level, the HAL maintains the priority in RAM and only installs the selected level in the hardware when the interrupt is enabled.
I now believe it was all caused by a glitch in the FPGA logic where sometimes attempting to disable an interrupt would actually enable it instead. I have managed to write some tests which prove the FPGA can malfunction in this way. In short I think all of the code in cyg_interrupt_attach, hal_interrupt_update_level and our platform extension is functioning correctly. I had basically missed the point that hal_interrupt_update_level consults cyg_hal_IMASK_table before deciding whether to enable or disable the interrupt.
I don't believe this patch to be necessary if everything else is working correctly.
