The __syscall_cancel_arch function has an epilogue that does not match the prologue. The stack is not used and the return address still lies in r15 when reaching the epilogue. Fix the epilogue by simply returning from the function. This bug was introduced by 89b53077d2a58f00e7debdfe58afabe953dac60d (BZ#12683).
Fixed on 2.43.