diff --git a/tools/sbl_patch.py b/tools/sbl_patch.py
index 6f591d7..0778060 100644
--- a/tools/sbl_patch.py
+++ b/tools/sbl_patch.py
@@ -553,10 +553,6 @@ def main():
 
         (0x801B76C, '280b0508', '00000708'),
 
-        (0x8006682, '00f001f8', 'c046c046'),
-
-        (0x8006684, '01f807bd', '46c046c0'),
-
         (0x8017AFC, 'bde8fc87', 'eef74fb8'),
 
         (0x802F690, '9847fee7', 'c046c046'),
@@ -569,6 +565,15 @@ def main():
 
         set4(d, va, new)
 
+    # Full bl idiom at 0x8006682 (bl + pop, 6B) -> NOPs. (b17 NOPed only
+    # its 2nd half, leaving a dangling prefix that fused with the NOP
+    # into a bogus odd-address store -> alignment fault in QEMU.)
+    o = off(0x8006682)
+
+    assert d[o:o + 6].hex() == '00f001f807bd', hx(d, 0x8006682, 6)
+
+    d[o:o + 6] = bytes.fromhex('c046c046c046')
+
     o = off(0x8013AA8)
 
     assert d[o:o + 4].hex() == '07f026be', hx(d, 0x8013AA8)