In Estatio we have an application action (ie action on a domain service tha appears in the menu) that has an disableXxx guard which queries the database.
If an error occurs, the transaction will be set to status ABORT.
When Isis tries to forwarding to the error page, the error page attempts to render the application actions, and hits a further error. This causes the error page to not be rendered either, getting a generic servlet container 503.
The correct thing to do, I think, is to suppress the application actions menu services from the error page.