The stack pointer being shown when a user thread gets an exception is on the kernel-mode stack, because _exception_enter doesn't take into account the automatic stack switch done by the CPU (as defined in the TSS) when an interrupt causes a privilege elevation.
Consequence is that the ESP value reported for such exceptions is wrong, an annoyance for debugging and also confounds logic to determine whether a stack overflow occurred. The exception is processed by the CPU properly.
This bug has been with us for a while.