https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108147
--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> --- => 0x000000001111bac0 <M2Emit_EmitError(unsigned int, unsigned int, unsigned int, DynamicStrings_String)+16>: std r0,16(r1) (gdb) p/x $r0 $46 = 0x1102fb0c (gdb) p/x $r1 $47 = 0x7fffffffe600 so lr stored to 0x7fffffffe610, then 0x000000001111bac4 <M2Emit_EmitError(unsigned int, unsigned int, unsigned int, DynamicStrings_String)+20>: stdu r1,-48(r1) On entry to m2linemap_WarningAtf r1 is still 0x7fffffffe5d0, and the function then does 0x0000000010ffc2f8 <+24>: stdu r1,-368(r1) and 0x7fffffffe5d0 - 368 + 432: 0x0000000010ffc320 <+64>: std r7,432(r1) 0x0000000010ffc324 <+68>: std r8,440(r1) is exactly at 0x7fffffffe610 where it overwrites the saved lr of parent. I have double checked and M2Emit.c should see the EXTERN void m2linemap_WarningAtf (location_t location, const char *message, ...); prototype for the function, so both should agree it is varargs.