https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102772
--- Comment #19 from Jakub Jelinek <jakub at gcc dot gnu.org> --- If it is the linker, you can always objdump -dr the binary to see what is in there after linking. s@ntpoff in my understanding is a relocation that should supply at link time the offset from the TLS base and at least on the GCC side it can appear anywhere where 32-bit immediate appears in an instruction (or in data section too), not necessarily in addl imm, %eax instruction. Perhaps also try to have 2 different functions, one with movl %gs:0, %eax addl $s@ntpoff, %eax ret and another with pushl %ebx movl %gs:0, %ebx addl $s@ntpoff, %ebx popl %ebx ret and see what they do at runtime (if they both print the same address in each thread or not).