The CEP cosim uses the isaTests as compiled from the ./toolchains/riscv-tools/riscv-tests directory per the instructions in ./sim/cep_cosim/README.md

As an example, looking at the rv64mi-p-csr.dump file when compiled on Ubuntu 22.04:
`
rv64mi-p-csr: file format elf64-littleriscv

Disassembly of section .text.init:

0000000080000040 <_start>:
80000040: 04c0006f j 8000008c <reset_vector>

0000000080000044 <trap_vector>:
80000044: 34202f73 csrr t5,mcause
80000048: 00800f93 li t6,8
8000004c: 03ff0a63 beq t5,t6,80000080 <write_tohost>
80000050: 00900f93 li t6,9
80000054: 03ff0663 beq t5,t6,80000080 <write_tohost>
80000058: 00b00f93 li t6,11
8000005c: 03ff0263 beq t5,t6,80000080 <write_tohost>
80000060: 00000f17 auipc t5,0x0
80000064: 3d8f0f13 addi t5,t5,984 # 80000438 <mtvec_handler>
80000068: 000f0463 beqz t5,80000070 <trap_vector+0x2c>
8000006c: 000f0067 jr t5
80000070: 34202f73 csrr t5,mcause
80000074: 000f5463 bgez t5,8000007c <handle_exception>
80000078: 0040006f j 8000007c <handle_exception>
...
`

The same file when compiled on RHEL8:
`
rv64mi-p-csr: file format elf64-littleriscv

Disassembly of section .text.init:

0000000080000000 <_start>:
80000000: 04c0006f j 8000004c <reset_vector>

0000000080000004 <trap_vector>:
80000004: 34202f73 csrr t5,mcause
80000008: 00800f93 li t6,8
8000000c: 03ff0a63 beq t5,t6,80000040 <write_tohost>
80000010: 00900f93 li t6,9
80000014: 03ff0663 beq t5,t6,80000040 <write_tohost>
80000018: 00b00f93 li t6,11
8000001c: 03ff0263 beq t5,t6,80000040 <write_tohost>
80000020: 00000f17 auipc t5,0x0
80000024: 3d8f0f13 addi t5,t5,984 # 800003f8 <mtvec_handler>
80000028: 000f0463 beqz t5,80000030 <trap_vector+0x2c>
8000002c: 000f0067 jr t5
80000030: 34202f73 csrr t5,mcause
80000034: 000f5463 bgez t5,8000003c <handle_exception>
80000038: 0040006f j 8000003c <handle_exception>
`

For some reason compiling Ubuntu introduces a 64 (0x40) byte offset in <_start>. This causes the CEP to jump to uninitialized memory at 0x80000000.