:: commit 90a07f0da6f7569adf11f58dc4ab7259c3404dce

diff --git a/stage23/menu.c b/stage23/menu.c
index b04c1066..fb063ca5 100644
--- a/stage23/menu.c
+++ b/stage23/menu.c
@@ -539,6 +539,7 @@ __attribute__((noreturn, naked))
 void menu(__attribute__((unused)) bool timeout_enabled) {
 #if defined (__i386__)
     asm volatile (
+        "pop %eax\n\t"
         "call 1f\n\t"
         "1:\n\t"
         "pop %eax\n\t"
@@ -546,14 +547,17 @@ void menu(__attribute__((unused)) bool timeout_enabled) {
         "cmpl $0, (%eax)\n\t"
         "jne 1f\n\t"
         "mov %esp, (%eax)\n\t"
-        "jmp _menu\n\t"
+        "jmp 3f\n\t"
         "1:\n\t"
         "mov (%esp), %edi\n\t"
         "mov (%eax), %esp\n\t"
         "push %edi\n\t"
-        "call _menu\n\t"
+        "jmp 3f\n\t"
         "2:\n\t"
-        ".long 0"
+        ".long 0\n\t"
+        "3:\n\t"
+        "push $0\n\t"
+        "jmp _menu"
     );
 #elif defined (__x86_64__)
     asm volatile (
@@ -561,9 +565,11 @@ void menu(__attribute__((unused)) bool timeout_enabled) {
         "cmp %rax, stack_at_first_entry(%rip)\n\t"
         "jne 1f\n\t"
         "mov %rsp, stack_at_first_entry(%rip)\n\t"
-        "jmp _menu\n\t"
+        "jmp 2f\n\t"
         "1:\n\t"
         "mov stack_at_first_entry(%rip), %rsp\n\t"
+        "2:\n\t"
+        "push $0\n\t"
         "jmp _menu"
     );
 #endif