The x86-64 movaps Alignment Trap

• libc functions (e.g. system) use SSE instructions like movaps that require RSP to be 16-byte aligned.
• If RSP % 16 != 0 at the call, you crash inside libc with a SIGSEGV on a movaps XMMWORD PTR [rsp...].
• Symptom: your chain looks perfect but dies deep inside libc, not in your gadgets.
• Fix: burn one extra ret gadget to shift RSP by 8 and restore alignment:

rop.raw(rop.ret)   # a bare 'ret' gadget = +8 to RSP, realigns to 16
rop.system(binsh)

{ Rule of thumb: if a 64-bit ret2libc mysteriously crashes in

libc, add one ret and try again.}