Hi Peter,
Because you are not using MPU, I assume you are not concerned about security/module isolation.
I'm not sure if your approach will work because typically the resident application is built using absolute positioning and modules are built with position independence. The registers may not be set up correctly (for relative offsets using R9) when the resident application is executing module functions.
Are you able to architect a solution where the module can use any of the existing ThreadX APIs that provide callback functionality? The module could, for example, create an event flags group and a notification function using tx_event_flags_set_notify. The module could then share the handle of the event flags group with the resident application, which would set a flag. The callback would be executed in the context of the module (every module has two hidden threads - the start/stop thread and the callback thread).