The key issue is that the workspace parameter of these IBoxes are not being executed on the first scan (SP0) because they are used in Stages. Hence, their "old" values are there whenever you go back to RUN mode (after a new download, program to run transition), meaning that whatever IBox thinks it "had the token" (or whatever state it was in), will continue to think "it has the token" when it "starts" executing, when it really doesn't, and will be waiting for a response in ITS error code parameter, but it will never see it because it really doesn't have the token, and it will be "hung".
The IBoxes were designed to work with Ladder, but are not "stage aware". This is something we've done with MX and made many of these "IBox" type "native" instructions be VERY "stage aware" in MX. Stage awareness is something that must be designed up-front at the firmware leve. IBoxes are just Ladder Macros, so in 450/260/250/06/05-land, there are some limitations. In MX-land, it's gonna be GOOD.
If you do the RESET of the workspace registers in an S100 stage (with the READ MODULE ID IBox), that should "reset" your S1 IBoxes so they "never" hang (except for a bad or missing module).