There are some dodgy code in the SDK sources where memory allocations are done without checking if they succeeded so it seems that the premature reboots occurs as a result of this as the new code is being downloaded and the allocation fails. I managed to recreate the reboot to user1 situation using the 0.9.3 SDK upgrade.c/upgrade_lib.c sources with the 0.9.4 SDK, To cure the symptom I changed a dynamic structure into a static one in upgrade_lib.c, but that really just moves the problem around. Will need to do some more error tracing to find where it goes wrong exactly.
/Bananis