@Test
	public void testDelayArmPopReturn1() throws Exception {

		builder = new ProgramBuilder("thunk", ProgramBuilder._ARM);

		builder.setBytes("0x00015d9c", "10 b5 03 48 10 bc 01 bc 00 47");
		builder.setRegisterValue("TMode", "0x00015d9c", "0x00015d9c", 1);
		builder.disassemble("0x00015d9c", 27, true);
		
		builder.createFunction("0x00015d9c");
		builder.createLabel("0x00015d9c", "func1");

		program = builder.getProgram();

		analyze();
		
		Instruction instruction = program.getListing().getInstructionAt(builder.addr(0x00015da4));
		assertNotNull(instruction);
		
		assertTrue("pop turned into return", instruction.getFlowType().isTerminal());
	}
This tests that a pop to the pc with the lr register is changed to a return

That the thunking function can be found with the constant reference analyzer
Ghidra/Processors/ARM/src/test.slow/java/ghidra/app/plugin/core/analysis/ArmBranchReturnDetectionTest.java