banner stub noreturn -> 0x802f694

qemu/banner.S

@@ -3,7 +3,8 @@
     .thumb
     @ Banner stub for SBL1 logger call at 0x802f690 (patched to bl here).
     @ r0 = string. Print raw bytes via UARTDM until NUL (cap 256).
-    @ Preserve lr (set by bl) and return to caller with r0=0.
+    @ The original callee is noreturn (b.n self follows the call), so
+    @ jump on to 0x802f694 (post-banner init) instead of returning.
     .text
     .global banner_stub
 banner_stub:
@@ -16,5 +17,4 @@ bn_loop:
     str r1, [r3, #0x70]
     b bn_loop
 bn_done:
-    movs r0, #0
-    pop {r4, pc}
+    ldr pc, =0x802f694

qemu/saimaa.c

@@ -441,12 +441,14 @@ static void saimaa_machine_init(MachineState *machine)
             }
             /* Banner stub at 0x08062150: print r0 string via UARTDM
              * (b16 redirects 0x802f690 blx here). Built from qemu/banner.S:
-             * push/pop frame, preserves lr, returns r0=0 to caller. */
+             * push frame, print loop, ldr pc,=0x802f694 (callee noreturn).
+             * 28 bytes total. */
             {
                 static const uint8_t bn[] = {
                     0x10, 0xb5, 0x4f, 0xf2, 0x00, 0x03, 0xc0, 0xf2,
                     0x8a, 0x73, 0x10, 0xf8, 0x01, 0x1b, 0x09, 0xb1,
-                    0x19, 0x67, 0xfa, 0xe7, 0x00, 0x20, 0x10, 0xbd,
+                    0x19, 0x67, 0xfa, 0xe7, 0xdf, 0xf8, 0x00, 0xf0,
+                    0x94, 0xf6, 0x02, 0x08,
                 };
                 size_t k;
                 for (k = 0; k < sizeof(bn); k += 4) {