From the processor (5234, 5270, 5282) manual:
If an interrupt source is being masked in the interrupt controller mask
register (IMR) or a module’s interrupt mask register while the
interrupt mask in the status register (SR[I]) is set to a value lower than
the interrupt’s level, a spurious interrupt may occur. This is because by
the time the status register acknowledges this interrupt, the interrupt
has been masked. A spurious interrupt is generated because the CPU
cannot determine the interrupt source. To avoid this situation for
interrupts sources with levels 1-6, first write a higher level interrupt
mask to the status register, before setting the mask in the IMR or the
module’s interrupt mask register. After the mask is set, return the
interrupt mask in the status register to its previous value. Since level 7
interrupts cannot be disabled in the status register prior to masking,
use of the IMR or module interrupt mask registers to disable level 7
interrupts is not recommended.
I don't know if this is part of your problem, but I would recommend putting UCOS_ENTER_CRITICAL() and UCOS_EXIT_CRITICAL() around your read-modify-write of the sim.tmr.imr register. this would prevent any spurious interrupt which may occur while disabling the timer interrupt, the spurious interrupt MIGHT be putting the timer into a weird or unexpected mode.
There is a lot of guesswork in this answer but it won't hurt to try.
I wrote these a while ago but never got any feedback.viewtopic.php?f=5&t=1116viewtopic.php?f=5&t=1117