At the end of BL2, the 4 first registers can be used to share info with next BL. In AARCH32, if SP_min is used as BL32, the arg3 (R3) cannot be used as this info gets overwritten. R3 is first saved in R12 at the beginning of SP_min, but R12 gets overwritten by zeromem function, losing the information from arg3.

A possible correction is to save R12 before calling zeromem, for example in R7, as this register doesn't seem to be used in that part of code. But this should be deeper checked.