> I'm a bit confused as to how the fallback handler can find the correct > RA but the "normal" unwind path can't.
The fallback knows what address range corresponds to the stubs. It's "magic". > How do all these things fit on the stack? Every stack frame has room for two return addresses. The stub just load the RA from the "secondary" slot and jumps to it.
