Gcc expects to be able to pick up the return address off the stack, so put one there for it. (Bug was hidden by bad segment limits.)