Indeed, in bytecode golfing, you can actually make use of SYSCALL's use of RCX for its return address: make a dummy syscall, then use RCX-relative addresses to

Indeed, in bytecode golfing, you can actually make use of SYSCALL's use of RCX for its return address: make a dummy syscall, then use RCX-relative addresses to refer to nearby data, since they're significantly shorter than RIP-relative addresses. (Something I still don't know: On returning from a syscall, is it ever possible for RCX to contain something other than the syscall's return address on Linux, assuming that another process isn't explicitly overwriting it through ptrace or other means? Some people have vaguely hinted so in the case of an interruption by a signal, but I have failed to find any actual example of this.)