diff --git a/tools/sbl_patch.py b/tools/sbl_patch.py
index 01e67d5..6f591d7 100644
--- a/tools/sbl_patch.py
+++ b/tools/sbl_patch.py
@@ -528,6 +528,9 @@ def main():
     # else restore r4/r5/sl/fp and return to sbl_main (0x802f681).
     # NOTE: overwrites BAE-path head (ldr r2,[pc,#0x28], only used when
     # [r7]==2 — never in our flow, r7=0).
+    # Also NOPs the FULL bl idiom at 0x8006682 (b17 NOPed only its 2nd
+    # half, leaving a dangling prefix that fused with the NOP into a
+    # bogus odd-address store -> alignment fault in QEMU).
     d = bytearray(base)
 
     for va, (a, b) in BLX2BL.items():
@@ -550,6 +553,8 @@ def main():
 
         (0x801B76C, '280b0508', '00000708'),
 
+        (0x8006682, '00f001f8', 'c046c046'),
+
         (0x8006684, '01f807bd', '46c046c0'),
 
         (0x8017AFC, 'bde8fc87', 'eef74fb8'),