Why "pop rdi ; ret" Is the Star Gadget

• pop rdi takes the next 8 bytes off the stack into RDI; ret then jumps to the value after it.
• So placing [&(pop rdi;ret)][value][&next] on the stack means: "set RDI = value, then continue to next."
• Analogous gadgets fill the other argument registers:
• pop rsi ; ret → arg2
• pop rdx ; ret → arg3
• Real binaries rarely have clean single-register pops; you often get pop rsi ; pop r15 ; ret and must supply a junk value for r15.