Although these registers are normally not accessible by the programmer, some undocumented instructions provide access to these registers, as will be described later. Reminds me of the MEMPTR on Z80: https://gist.github.com/drhelius/8497817 Also, I'm not sure if you've explored 8f/1-7 yet, since it's not mentioned in the article, but I suspect it's just the same as pop r/m16 (8f/0) as it ignores the subopcode bits com…
I agree that it's very weird that PUSH rm and POP rm are arranged completely differently. The obvious place to put POP would be in FF/7, especially since that spot is unused. I can't think of any reason why they wouldn't do that.