Got root! Issue was in stage 1, the ‘access denied.’ I had recvline instead of recv, now the stage 2 offsets are right!