Often the user error handler will catch an uninitialized interrupt. For instance, divide-by-zero generates an interrupt and sends execution to the divide-by-zero vector. If you haven't defined an error handler for that, then it vectors to the default error handler. So, your XPC:Addr will be pointing to the catch-all error routine. That's probably why it isn't pointing to your code.
I wrote a routine to try and snapshot the bottom of the stack and send it to me. You can find that code here
. Then you have to trace back the return addresses that are between the arguments that have been pushed onto the stack.