A GCC trampoline hack calls nested functions without an executable stack on releases before GCC 17

Sources: primary, discussion
Summary: The post, dated 2026-08-29, describes calling a nested function through its address on GCC releases before 17 without marking the stack executable. It reads the code address and the static chain out of the two immediate constants in the trampoline GCC emits, calls the target through __builtin_call_with_static_chain, and clears the executable-stack flag on the resulting binary with patchelf. The trampoline is still emitted and the indirect call still cannot be devirtualized, so the technique buys the stack permission and not the code generation.
Why it matters: Hardened toolchains and kernels reject an executable stack, and this puts the fix on compilers already deployed instead of gating it on an upgrade to a GCC release that no longer requires the trampoline.