Things will fire twice, or continuously, if the cause what not properly cleared.
There's also the fact that the processor is pipelined, and has deferred writes via the write buffers.
The tail-chaining decisions can be made before the interrupt service/clearance propogates from the peripheral on a slower bus vs the NVIC tightly coupled to the core.
Always qualify the source of the interrupt, don't respond blindly.
An interrupt may enter with one, or many things signalling. Things may also occur in the time domain as the code executes.
