diff --git a/os/common/startup/ARMCMx-SB/compilers/GCC/crt0.S b/os/common/startup/ARMCMx-SB/compilers/GCC/crt0.S
index a19c456ed..57a4aa969 100644
--- a/os/common/startup/ARMCMx-SB/compilers/GCC/crt0.S
+++ b/os/common/startup/ARMCMx-SB/compilers/GCC/crt0.S
@@ -107,11 +107,11 @@ __sandbox:      .long       0xFE9154C0
                 .bss
 
                 .align      2
-                .global __sb_parameters
+                .global     __sb_parameters
 __sb_parameters:
                 .ds.l       1
                 .ds.l       1
-                .global environ                 /* Required by newlib.*/
+                .global     environ             /* Required by newlib.*/
 environ:
                 .ds.l       1
                 .ds.l       1
@@ -227,7 +227,7 @@ finiloop:
 endfiniloop:
 #endif /* CRT0_CALL_DESTRUCTORS == TRUE */
                 ldr     r1, =__sandbox
-                ldr     r2, [r1], #16           /* Predefined exit vector.*/
+                ldr     r2, [r1, #16]           /* Predefined exit vector.*/
                 bx      r2
 
 #endif /* !defined(__DOXYGEN__) */
diff --git a/os/sb/apps/msh/source/callhdr.S b/os/sb/apps/msh/source/callhdr.S
index 39841556b..886a39d00 100644
--- a/os/sb/apps/msh/source/callhdr.S
+++ b/os/sb/apps/msh/source/callhdr.S
@@ -52,14 +52,14 @@ __callelf_data:
                 .global     __callelf
 __callelf:
                 ldr         r4, =__callelf_data
-                str         sp, [r4], #0
-                str         lr, [r4], #4
+                str         sp, [r4, #0]
+                str         lr, [r4, #4]
 
                 /* Setting up the call stack for the loaded module.*/
-                ldr         r5, [r0], #20       /* Placed by runelf().      */
+                ldr         r5, [r0, #20]       /* Placed by runelf().      */
                 mov         sp, r5
                 push        {r1, r2, r3, r5}    /* argc, argv, envp, top.   */
-                ldr         r6, [r0], #16
+                ldr         r6, [r0, #12]
                 bx          r6                  /* Jumping to entry point.  */
 
                 /* Call elf return code.*/
@@ -68,9 +68,9 @@ __callelf:
                 .global     __returnelf
 __returnelf:
                 ldr         r4, =__callelf_data
-                ldmdb       r4, {r5, lr}
+                ldmia       r4, {r5, r6}
                 mov         sp, r5
-                bx          lr
+                bx          r6
 
 #endif /* !defined(__DOXYGEN__) */
 
diff --git a/os/sb/apps/msh/source/runelf.c b/os/sb/apps/msh/source/runelf.c
index aa001ff82..babc4cf98 100644
--- a/os/sb/apps/msh/source/runelf.c
+++ b/os/sb/apps/msh/source/runelf.c
@@ -56,5 +56,6 @@ int runelf(const char *fname, int argc, char *argv[], char *envp[]) {
 
   /* Setting up the exit vector for the loaded elf file.*/
   sbhp->hdr_exit = (uint32_t)__returnelf;
+  sbhp->user[0]  = (uint32_t)bufend;
   return __callelf(sbhp, argc, argv, envp);
 }