"Return to function" still vulnerable