R14 (LR) doesn't contain the address to return to when exiting an exception (as you have found) instead it contains information about whether to return to handler or thread mode, which stack pointer to use (msp or psp), and whether it's a floating point context.

This is detailed in the section about Exception entry and exit in the Arm Cortex M4 generic user guide, page 2-2 8.

R14 (LR) doesn't contain the address to return to when exiting an exception (as you have found) instead it contains information about whether to return to handler or thread mode, which stack pointer to use (msp or psp), and whether it's a floating point context.

This is detailed in the section about Exception entry and exit in the Arm Cortex M4 generic user guide, page 2-28.

The program counter (amongst others) was pushed onto the stack during exception entry, when the processor leaves the exception handler it pops the pc back off the stack and carries on. In this instance the stack pointer used is changed during the exception, which allows the task to switch.