i’ve often wondered this. but wrt ROP sled, does it matter? instead of overwriting “this” stack frame’s ret address, you’d overwrite the previous. the effect would be seen when your caller returns instead of when you return.