X86: correct tail return address calculation