I was confused by that part (the differing number of pushes and pulls) too when I read the log, but given the SEP #10, it should have gone from a 16-bit X register to an 8-bit register before it starts pulling from the stack, if I'm reading the processor flag documentation correctly. Both X and A were 16-bit, so 6 bytes were pushed then.