diff --git a/springbok/crt0.S b/springbok/crt0.S
index 21240c0..1732eb8 100644
--- a/springbok/crt0.S
+++ b/springbok/crt0.S
@@ -181,17 +181,18 @@
         addi sp, sp, 16
 
 _finish:
+        # At ret we have 3 u32 values: return code, fault PC (if any), and
+        # output length (to be added with MlOutput cleanup).
+        la   t0, _ret
 #ifndef LIBSPRINGBOK_NO_EXCEPTION_SUPPORT
         # Store the application's return value and machine exception program
-        # counter onto the stack
-        addi sp, sp, -8
-        sw   a0, 0(sp)
-        csrr t0, mepc
-        sw   t0, 4(sp)
+        # counter at _ret
+        sw   a0, 0(t0)
+        csrr t1, mepc
+        sw   t1, 4(t0)
 #else
-        # Store the application's return value onto the stack
-        addi sp, sp, -4
-        sw   a0, 0(sp)
+        # Store the application's return value at _ret
+        sw   a0, 0(t0)
 #endif
 1:
         .word 0x0000307B # finish (encoded as custom3<func3=3>)
diff --git a/springbok/springbok.ld b/springbok/springbok.ld
index a3ddc65..df28ba8 100644
--- a/springbok/springbok.ld
+++ b/springbok/springbok.ld
@@ -77,6 +77,9 @@
         {
                 . = ALIGN(64);
                 _smodel_output = .;
+                _ret = .;
+                /* Reserve 12 bytes for return information. */
+                . = . + 12;
                 *(.model_output*)
                 _emodel_output = .;
         } > MODEL_OUTPUT
diff --git a/springbok/springbok_no_wmmu.ld b/springbok/springbok_no_wmmu.ld
index 2f6a194..389c616 100644
--- a/springbok/springbok_no_wmmu.ld
+++ b/springbok/springbok_no_wmmu.ld
@@ -69,11 +69,13 @@
                 PROVIDE(__fini_array_end = .);
         } > TCM
 
-
         .model_output :
         {
                 . = ALIGN(64);
                 _smodel_output = .;
+                _ret = .;
+                /* Reserve 12 bytes for return information. */
+                . = . + 12;
                 *(.model_output*)
                 _emodel_output = .;
         } > TCM