diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index 51bb914..5d104ea 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -434,6 +434,9 @@ static void saimaa_machine_init(MachineState *machine)
              * to 0x08062200 for post-mortem, then movs r0,#0; bx lr. */
             w = S + 8;
             cpu_physical_memory_write(S, &w, 4);
+            /* [struct+4] is another fn ptr (e.g. 0x801b72e ldr r3,[r0,#4]
+             * with r0 = maze S via POOLS redirect); point at STUB too */
+            cpu_physical_memory_write(S + 4, &STUB, 4);
             cpu_physical_memory_write(S + 8, &STUB, 4);
             {
                 /* from qemu/maze.S: movw/movt r12; str lr/sp; movs; bx */