What I tell looks like to '10740 Intel syntax far jumps broken'. But it is about the case that jmp's operand is integer. My report is about that is memory and registers. I wrote the following in a file whose extension is S. .text .code32 ljmp *4(%esp) .intel_syntax noprefix jmp far[esp+4] I think both jmp commands have same meaning. But they were assembled into the different machine code. 'jmp far[esp+4]' -> 'FF A4 24 0A FF 00 00' 'ljmp *4(%esp)' -> 'FF 6C 24 04' 'FF A4 24 0A FF 00 00' is wrong machine code to work as I thought.
"far" without "ptr" is treated as a number, 0xff06. You can use jmp far ptr[esp+4] to get indirect far jmp.