Seems like this was broken all along. The safe zone is at the lower addresses of the stack, not the higher addresses.