Note: We know opcode 0x5C = POP ESP & opcode 0xCF = IRET.

kdb:> idt
IDT Base: 0x8079d400  Limit: 0x07ff
  Idx  Type        Seg. Sel.  Offset      DPL
  000  INTGATE32   0x0008     0x80802efc  00
  001  INTGATE32   0x0008     0x80802f89  00
  002  TASKGATE    0x0058                 00
  003  INTGATE32   0x0008     0x80803016  03
  004  INTGATE32   0x0008     0x808030a3  03

kdb:> x 0x808030a3 L4
<NTOSKRNL.EXE:30a3 (:0 (KiTrap04))>: 5ccfec83 8960246c 895c245c 89582474

**  From the first dword 5ccfec82 above it looks like address 30a3 contains 0x5c (IRET)
**  and address 30a4 contains 0xcf (POP ESP)

kdb:> disasm 0x808030a3
<NTOSKRNL.EXE:30a3 (:0 (KiTrap04))>: sub    $0xffffffcf,%esp
<NTOSKRNL.EXE:30a6 (:0 (KiTrap04))>: pop    %esp
<NTOSKRNL.EXE:30a7 (:0 (KiTrap04))>: insb   (%dx),%es:(%edi)


kdb:> disasm 0x808030a4
<NTOSKRNL.EXE:30a4 (:0 (KiTrap04))>: in     (%dx),%al
<NTOSKRNL.EXE:30a5 (:0 (KiTrap04))>: iret   
<NTOSKRNL.EXE:30a6 (:0 (KiTrap04))>: pop    %esp
<NTOSKRNL.EXE:30a7 (:0 (KiTrap04))>: insb   (%dx),%es:(%edi)


kdb:> disasm 0x808030a5
<NTOSKRNL.EXE:30a5 (:0 (KiTrap04))>: iret            <== opcode 0xCF appeared to be at 30a4 but is at 30a5
<NTOSKRNL.EXE:30a6 (:0 (KiTrap04))>: pop    %esp


kdb:> disasm 0x808030a6
<NTOSKRNL.EXE:30a6 (:0 (KiTrap04))>: pop    %esp     <== opcode 0x5C appeared to be at 30a3 but is at 30a6
<NTOSKRNL.EXE:30a7 (:0 (KiTrap04))>: insb   (%dx),%es:(%edi)


If we swapped the four byte set from aabbccdd to ddccbbaa then the disasm code would be correct.
It appears that the memory bytes are not displayed in their correct order but are reversed withing the dword.