diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index 364c76f..947b082 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -779,23 +779,21 @@ static void saimaa_machine_init(MachineState *machine)
                 uint32_t v = 0x47702000;
                 cpu_physical_memory_write(0x00221EF8, &v, 4);
             }
-             /* S12-stub (b27, 108B @0x08006964, ARM): blx-to-padding
+             /* S12-stub (b27, 100B @0x08006964, ARM): blx-to-padding
              * becomes smart dispatcher: ldr ip,[sp,#4] (=pushed lr);
              * ip==STUBV/even/non-code => ip=poll resumption 0x8007779;
-             * else keep pushed-lr AND add sp,#8 (pop the helper frame
-             * B66 skips! un-leak!); restore r7; ACK peripheral bit1
-             * ([literal 0x073A100]); bx lr.
+             * else keep pushed-lr (NO add-sp!); restore r7;
+             * ACK peripheral bit1 ([literal 0x073A100]); bx lr.
              * PBL would place the real ARM helper here. */
             {
                 static const uint8_t s12[] = {
                     0x04, 0xc0, 0x9d, 0xe5, 0x8d, 0x3b, 0x06, 0xe3,
                     0x00, 0x38, 0x40, 0xe3, 0x03, 0x00, 0x5c, 0xe1,
-                    0x0b, 0x00, 0x00, 0x0a, 0x01, 0x00, 0x1c, 0xe3,
-                    0x09, 0x00, 0x00, 0x0a, 0x2c, 0x3c, 0xa0, 0xe1,
-                    0x08, 0x00, 0x53, 0xe3, 0x01, 0x00, 0x00, 0x1a,
-                    0x08, 0xd0, 0x8d, 0xe2, 0x06, 0x00, 0x00, 0xea,
-                    0x2c, 0x3e, 0xa0, 0xe1, 0x08, 0x00, 0x53, 0xe3,
-                    0x01, 0x00, 0x00, 0x1a, 0x08, 0xd0, 0x8d, 0xe2,
+                    0x09, 0x00, 0x00, 0x0a, 0x01, 0x00, 0x1c, 0xe3,
+                    0x07, 0x00, 0x00, 0x0a, 0x2c, 0x3c, 0xa0, 0xe1,
+                    0x08, 0x00, 0x53, 0xe3, 0x00, 0x00, 0x00, 0x1a,
+                    0x05, 0x00, 0x00, 0xea, 0x2c, 0x3e, 0xa0, 0xe1,
+                    0x08, 0x00, 0x53, 0xe3, 0x00, 0x00, 0x00, 0x1a,
                     0x01, 0x00, 0x00, 0xea, 0x79, 0xc7, 0x07, 0xe3,
                     0x00, 0xc8, 0x40, 0xe3, 0x00, 0x70, 0x0a, 0xe3,
                     0x73, 0x70, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5,
diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py
index 1ae691c..313061e 100644
--- a/tools/sbl_uni.py
+++ b/tools/sbl_uni.py
@@ -457,18 +457,18 @@ def main():
     # to the dispatcher via stale lr (TZ bringup deferred).
     # NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
     mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
-    # S12-stub (b27, 108B @0x08006964, ARM): blx-to-padding becomes
+    # S12-stub (b27, 100B @0x08006964, ARM): blx-to-padding becomes
     # smart dispatcher: ldr ip,[sp,#4] (=pushed lr); ip==STUBV/even/
     # non-code => ip=poll resumption 0x8007779; else keep pushed-lr
-    # AND add sp,#8 (pop the helper frame B66 skips! un-leak!);
-    # restore r7; ACK peripheral bit1 ([literal]); bx lr.
+    # (NO add-sp: marches on mid-entries! un-leak dropped, helper-leak
+    # down is harmless); restore r7; ACK peripheral bit1; bx lr.
     # PBL would place the real ARM helper here.
     mu.mem_write(0x08006964, bytes.fromhex(
-        "04c09de58d3b06e3003840e303005ce10b00000a0100"
-        "1ce30900000a2c3ca0e1080053e30100001a08d08de2"
-        "060000ea2c3ea0e1080053e30100001a08d08de20100"
-        "00ea79c707e300c840e300700ae3737040e30c309fe5"
-        "002093e5022082e3002083e51eff2fe100a17300"))
+        "04c09de58d3b06e3003840e303005ce10900000a0100"
+        "1ce30700000a2c3ca0e1080053e30000001a050000ea"
+        "2c3ea0e1080053e30000001a010000ea79c707e300c8"
+        "40e300700ae3737040e30c309fe5002093e5022082e3"
+        "002083e51eff2fe100a17300"))
     # S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
     # ip==STUBV (fill/maze, never a legit return) => default;
     # ip odd + top 8 (code) => add sp,#8 (pop the helper frame B66