Created attachment 107951 [details] Example binary with ldr pc, [sp], #4 used as ret. When processing ARM instruction in thumb mode: 5D F8 04 FB LDR.W PC, [SP],#4 IRSB jumpkind is set to Ijk_Broing, should be Ijk_Ret. See example in attached wget binary. Function - sub_227D0, block start addr - 00022878, ret instr addr - 00022890.