>> Is there a requirement that the return address is popped from the same >> stack location where it was pushed by the call instruction? Or could >> you return with an elevated stack pointer if you copied the address first? > Stack location isn't checked. Only the popped return address is checked. > Vedvyas can confirm it. Yes. That’s correct.